{ "events": [ { "@timestamp": "2021-05-05T15:30:51.692Z", "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "record_id": 66, "computer_name": "vagrant-2016", "time_created": "2019-07-18T03:34:02.025Z", "level": "information", "event_data": { "UtcTime": "2019-07-18 03:34:01.239", "ProcessGuid": "{fa4a0de6-e8a8-5d2f-0000-001094619900}", "ProcessId": "356", "QueryName": "go.microsoft.com", "QueryStatus": "0", "QueryResults": "type: 5 go.microsoft.com.edgekey.net;type: 5 e11290.dspg.akamaiedge.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files\\Internet Explorer\\iexplore.exe" }, "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } } }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:02.025223900Z'/\u003e\u003cEventRecordID\u003e66\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:01.239\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a8-5d2f-0000-001094619900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e356\u003c/Data\u003e\u003cData Name='QueryName'\u003ego.microsoft.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 go.microsoft.com.edgekey.net;type: 5 e11290.dspg.akamaiedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.692Z", "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "record_id": 67, "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "provider_name": "Microsoft-Windows-Sysmon", "time_created": "2019-07-18T03:34:02.025Z", "event_data": { "QueryName": "www.msn.com", "QueryStatus": "0", "QueryResults": "type: 5 www-msn-com.a-0003.a-msedge.net;type: 5 a-0003.a-msedge.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:01.261", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "process": { "pid": 2828, "thread": { "id": 1684 } } }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:02.025237700Z'/\u003e\u003cEventRecordID\u003e67\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:01.261\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ewww.msn.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 www-msn-com.a-0003.a-msedge.net;type: 5 a-0003.a-msedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.692Z", "winlog": { "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2012-r2", "record_id": 612, "time_created": "2020-05-07T08:14:44.489Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "RuleName": "-", "ProcessId": "2184", "User": "VAGRANT-2012-R2\\vagrant", "Image": "C:\\Users\\vagrant\\.gvm\\versions\\go1.13.10.windows.amd64\\bin\\go.exe", "TargetFilename": "C:\\Users\\vagrant\\AppData\\Local\\Temp\\1\\go-build583768550\\b001\\test.test.exe", "Hashes": "MD5=199E1CF5B2250BD515ECCCF4CA686301,IMPHASH=D90D8C7812AEC8DA0FA173AFA1293AB2", "Archived": "true", "UtcTime": "2020-05-07 08:14:44.489", "ProcessGuid": "{42f11c3b-c36f-5eb3-2c07-290000000000}", "IsExecutable": "true" }, "process": { "pid": 664, "thread": { "id": 2360 } }, "event_id": "23", "provider_name": "Microsoft-Windows-Sysmon" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e23\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e23\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-07T08:14:44.489978500Z'/\u003e\u003cEventRecordID\u003e612\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='664' ThreadID='2360'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e-\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2020-05-07 08:14:44.489\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-c36f-5eb3-2c07-290000000000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2184\u003c/Data\u003e\u003cData Name='User'\u003eVAGRANT-2012-R2\\vagrant\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Users\\vagrant\\.gvm\\versions\\go1.13.10.windows.amd64\\bin\\go.exe\u003c/Data\u003e\u003cData Name='TargetFilename'\u003eC:\\Users\\vagrant\\AppData\\Local\\Temp\\1\\go-build583768550\\b001\\test.test.exe\u003c/Data\u003e\u003cData Name='Hashes'\u003eMD5=199E1CF5B2250BD515ECCCF4CA686301,IMPHASH=D90D8C7812AEC8DA0FA173AFA1293AB2\u003c/Data\u003e\u003cData Name='IsExecutable'\u003etrue\u003c/Data\u003e\u003cData Name='Archived'\u003etrue\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "23", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.692Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:02.025262300Z'/\u003e\u003cEventRecordID\u003e68\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:01.449\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003estatic-global-s-msn-com.akamaized.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 a1999.dscg2.akamai.net;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" }, "winlog": { "record_id": 68, "opcode": "Info", "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:02.025Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_id": "22", "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:01.449", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "static-global-s-msn-com.akamaized.net", "QueryStatus": "0", "QueryResults": "type: 5 a1999.dscg2.akamai.net;::ffff:89.160.20.156;::ffff:89.160.20.156;" } } }, { "@timestamp": "2021-05-05T15:30:51.692Z", "winlog": { "event_data": { "UtcTime": "2019-07-18 03:34:01.457", "ProcessGuid": "{fa4a0de6-e8a8-5d2f-0000-001094619900}", "ProcessId": "356", "QueryName": "www.bing.com", "QueryStatus": "0", "QueryResults": "type: 5 a-0001.a-afdentry.net.trafficmanager.net;type: 5 dual-a-0001.a-msedge.net;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files\\Internet Explorer\\iexplore.exe" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "record_id": 69, "version": 5, "level": "information", "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:02.025Z", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon" }, "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:02.025273600Z'/\u003e\u003cEventRecordID\u003e69\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:01.457\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a8-5d2f-0000-001094619900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e356\u003c/Data\u003e\u003cData Name='QueryName'\u003ewww.bing.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 a-0001.a-afdentry.net.trafficmanager.net;type: 5 dual-a-0001.a-msedge.net;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22" } }, { "@timestamp": "2021-05-05T15:30:51.692Z", "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "record_id": 2682, "computer_name": "vagrant", "version": 2, "time_created": "2020-05-05T14:57:40.599Z", "process": { "pid": 5496, "thread": { "id": 876 } }, "event_id": "13", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessId": "6072", "Image": "C:\\Windows\\regedit.exe", "TargetObject": "HKU\\S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Key 1", "Details": "DWORD (0x00000004)", "RuleName": "-", "EventType": "SetValue", "UtcTime": "2020-05-05 14:57:40.589", "ProcessGuid": "{5b522f6e-77ae-5eb1-2c03-000000000800}" }, "channel": "Microsoft-Windows-Sysmon/Operational" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e13\u003c/EventID\u003e\u003cVersion\u003e2\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e13\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-05T14:57:40.599567200Z'/\u003e\u003cEventRecordID\u003e2682\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='5496' ThreadID='876'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e-\u003c/Data\u003e\u003cData Name='EventType'\u003eSetValue\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2020-05-05 14:57:40.589\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{5b522f6e-77ae-5eb1-2c03-000000000800}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e6072\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\regedit.exe\u003c/Data\u003e\u003cData Name='TargetObject'\u003eHKU\\S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Key 1\u003c/Data\u003e\u003cData Name='Details'\u003eDWORD (0x00000004)\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "13", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.692Z", "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "record_id": 11, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2020-05-07T07:27:18.722Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "Hashes": "SHA1=115106F5B338C87AE6836D50DD890DE3DA296367", "Archived": "true", "RuleName": "-", "ProcessGuid": "{42f11c3b-b2b6-5eb3-18ab-000000000000}", "ProcessId": "776", "User": "NT AUTHORITY\\LOCAL SERVICE", "Image": "C:\\Windows\\System32\\svchost.exe", "TargetFilename": "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\lastalive0.dat", "UtcTime": "2020-05-07 07:27:18.722", "IsExecutable": "false" }, "process": { "thread": { "id": 2360 }, "pid": 664 }, "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2012-r2", "opcode": "Info", "version": 5, "level": "information", "event_id": "23" }, "event": { "provider": "Microsoft-Windows-Sysmon", "code": "23", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e23\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e23\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-07T07:27:18.722136100Z'/\u003e\u003cEventRecordID\u003e11\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='664' ThreadID='2360'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e-\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2020-05-07 07:27:18.722\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-b2b6-5eb3-18ab-000000000000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e776\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\LOCAL SERVICE\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003cData Name='TargetFilename'\u003eC:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\lastalive0.dat\u003c/Data\u003e\u003cData Name='Hashes'\u003eSHA1=115106F5B338C87AE6836D50DD890DE3DA296367\u003c/Data\u003e\u003cData Name='IsExecutable'\u003efalse\u003c/Data\u003e\u003cData Name='Archived'\u003etrue\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.692Z", "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "record_id": 70, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:02.025Z", "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessId": "2736", "QueryName": "linkmaker.itunes.apple.com", "QueryStatus": "0", "QueryResults": "type: 5 linkmaker.itunes.apple.com.edgekey.net;type: 5 e4541.dsce9.akamaiedge.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:01.494", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "event_id": "22" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:02.025284200Z'/\u003e\u003cEventRecordID\u003e70\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:01.494\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003elinkmaker.itunes.apple.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 linkmaker.itunes.apple.com.edgekey.net;type: 5 e4541.dsce9.akamaiedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.692Z", "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:02.025317300Z'/\u003e\u003cEventRecordID\u003e71\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:01.810\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003econfiant-integrations.global.ssl.fastly.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22" }, "winlog": { "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:01.810", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "confiant-integrations.global.ssl.fastly.net", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "version": 5, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:02.025Z", "level": "information", "event_id": "22", "record_id": 71, "computer_name": "vagrant-2016" } }, { "@timestamp": "2021-05-05T15:30:51.692Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:02.025330400Z'/\u003e\u003cEventRecordID\u003e72\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:01.894\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ec.msn.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 c.msn.com.nsatc.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 72, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:02.025Z", "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "opcode": "Info", "user": { "identifier": "S-1-5-18" }, "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:01.894", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "c.msn.com", "QueryStatus": "0", "QueryResults": "type: 5 c.msn.com.nsatc.net;::ffff:89.160.20.156;" } } }, { "@timestamp": "2021-05-05T15:30:51.693Z", "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:02.025Z", "event_data": { "ProcessId": "2736", "QueryName": "c.bing.com", "QueryStatus": "0", "QueryResults": "type: 5 c-bing-com.a-0001.a-msedge.net;type: 5 dual-a-0001.a-msedge.net;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:01.948", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "record_id": 73, "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" } }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:02.025347300Z'/\u003e\u003cEventRecordID\u003e73\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:01.948\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ec.bing.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 c-bing-com.a-0001.a-msedge.net;type: 5 dual-a-0001.a-msedge.net;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.694Z", "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.028190100Z'/\u003e\u003cEventRecordID\u003e74\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.085\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003econtextual.media.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" }, "winlog": { "version": 5, "time_created": "2019-07-18T03:34:03.028Z", "level": "information", "event_data": { "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.085", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "contextual.media.net" }, "event_id": "22", "record_id": 74, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "process": { "thread": { "id": 1684 }, "pid": 2828 }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "user": { "identifier": "S-1-5-18" } } }, { "@timestamp": "2021-05-05T15:30:51.694Z", "event": { "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.028274700Z'/\u003e\u003cEventRecordID\u003e75\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.174\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eat.atwola.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 glb-ads.atwola.adtechus.com;type: 5 cs670.wac.thetacdn.net;type: 5 cs670.lb.wac.apr-1b09e.edgecastdns.net;type: 5 cs935.wac.thetacdn.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "22" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 75, "opcode": "Info", "version": 5, "event_data": { "UtcTime": "2019-07-18 03:34:02.174", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "at.atwola.com", "QueryStatus": "0", "QueryResults": "type: 5 glb-ads.atwola.adtechus.com;type: 5 cs670.wac.thetacdn.net;type: 5 cs670.lb.wac.apr-1b09e.edgecastdns.net;type: 5 cs935.wac.thetacdn.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.028Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.694Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.028358900Z'/\u003e\u003cEventRecordID\u003e76\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.274\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003em.adnxs.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 microsoft.geo.appnexusgslb.net;type: 5 m.anycast.adnxs.com;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event" }, "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:03.028Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_data": { "QueryResults": "type: 5 microsoft.geo.appnexusgslb.net;type: 5 m.anycast.adnxs.com;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.274", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "m.adnxs.com", "QueryStatus": "0" }, "record_id": 76, "computer_name": "vagrant-2016" } }, { "@timestamp": "2021-05-05T15:30:51.694Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.028412800Z'/\u003e\u003cEventRecordID\u003e77\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.291\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ecms.analytics.yahoo.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 spcms-global.pbp.gysm.yahoodns.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 77, "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "time_created": "2019-07-18T03:34:03.028Z", "event_data": { "QueryName": "cms.analytics.yahoo.com", "QueryStatus": "0", "QueryResults": "type: 5 spcms-global.pbp.gysm.yahoodns.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.291", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22" } }, { "@timestamp": "2021-05-05T15:30:51.694Z", "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.028501000Z'/\u003e\u003cEventRecordID\u003e78\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.413\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ecvision.media.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 cvision.media.net.edgekey.net;type: 5 e607.d.akamaiedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" }, "winlog": { "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.028Z", "event_data": { "QueryStatus": "0", "QueryResults": "type: 5 cvision.media.net.edgekey.net;type: 5 e607.d.akamaiedge.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.413", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "cvision.media.net" }, "provider_name": "Microsoft-Windows-Sysmon", "event_id": "22", "record_id": 78, "opcode": "Info", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational" } }, { "@timestamp": "2021-05-05T15:30:51.694Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.028585600Z'/\u003e\u003cEventRecordID\u003e79\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.424\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eg.bing.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 g-bing-com.a-0001.a-msedge.net;type: 5 dual-a-0001.a-msedge.net;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "event_data": { "UtcTime": "2019-07-18 03:34:02.424", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "g.bing.com", "QueryStatus": "0", "QueryResults": "type: 5 g-bing-com.a-0001.a-msedge.net;type: 5 dual-a-0001.a-msedge.net;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "time_created": "2019-07-18T03:34:03.028Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "record_id": 79, "computer_name": "vagrant-2016", "version": 5, "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.694Z", "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.028900300Z'/\u003e\u003cEventRecordID\u003e80\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.427\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003elg3.media.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22" }, "winlog": { "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 80, "computer_name": "vagrant-2016", "version": 5, "time_created": "2019-07-18T03:34:03.028Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "user": { "identifier": "S-1-5-18" }, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "event_data": { "ProcessId": "2736", "QueryName": "lg3.media.net", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.427", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "opcode": "Info" } }, { "@timestamp": "2021-05-05T15:30:51.694Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029031100Z'/\u003e\u003cEventRecordID\u003e81\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.469\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eservice.sp.advertising.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 service.sp.aolp-ds-prd.aws.oath.cloud;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 81, "computer_name": "vagrant-2016", "opcode": "Info", "time_created": "2019-07-18T03:34:03.029Z", "level": "information", "event_data": { "QueryResults": "type: 5 service.sp.aolp-ds-prd.aws.oath.cloud;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.469", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "service.sp.advertising.com", "QueryStatus": "0" }, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.692Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e13\u003c/EventID\u003e\u003cVersion\u003e2\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e13\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-05T14:57:44.723248500Z'/\u003e\u003cEventRecordID\u003e2686\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='5496' ThreadID='876'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e-\u003c/Data\u003e\u003cData Name='EventType'\u003eSetValue\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2020-05-05 14:57:44.714\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{5b522f6e-7554-5eb1-6d00-000000000800}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4320\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\Explorer.EXE\u003c/Data\u003e\u003cData Name='TargetObject'\u003eHKU\\S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\HRZR_PGYFRFFVBA\u003c/Data\u003e\u003cData Name='Details'\u003eBinary Data\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "13", "kind": "event" }, "winlog": { "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "TargetObject": "HKU\\S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\HRZR_PGYFRFFVBA", "Details": "Binary Data", "RuleName": "-", "EventType": "SetValue", "UtcTime": "2020-05-05 14:57:44.714", "ProcessGuid": "{5b522f6e-7554-5eb1-6d00-000000000800}", "ProcessId": "4320", "Image": "C:\\Windows\\Explorer.EXE" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 2, "event_id": "13", "record_id": 2686, "computer_name": "vagrant", "time_created": "2020-05-05T14:57:44.723Z", "process": { "pid": 5496, "thread": { "id": 876 } } } }, { "@timestamp": "2021-05-05T15:30:51.694Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029098400Z'/\u003e\u003cEventRecordID\u003e82\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.485\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003esb.scorecardresearch.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 sb.scorecardresearch.com.edgekey.net;type: 5 e1879.e7.akamaiedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "record_id": 82, "time_created": "2019-07-18T03:34:03.029Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "event_data": { "ProcessId": "2736", "QueryName": "sb.scorecardresearch.com", "QueryStatus": "0", "QueryResults": "type: 5 sb.scorecardresearch.com.edgekey.net;type: 5 e1879.e7.akamaiedge.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.485", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "event_id": "22", "computer_name": "vagrant-2016" } }, { "@timestamp": "2021-05-05T15:30:51.694Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029112900Z'/\u003e\u003cEventRecordID\u003e83\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.500\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eotf.msn.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 iceotf-prod-fe-tm.trafficmanager.net;type: 5 iceotf-prod-fe-eastus.cloudapp.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "record_id": 83, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "computer_name": "vagrant-2016", "version": 5, "time_created": "2019-07-18T03:34:03.029Z", "event_data": { "QueryResults": "type: 5 iceotf-prod-fe-tm.trafficmanager.net;type: 5 iceotf-prod-fe-eastus.cloudapp.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.500", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "otf.msn.com", "QueryStatus": "0" }, "channel": "Microsoft-Windows-Sysmon/Operational" } }, { "@timestamp": "2021-05-05T15:30:51.692Z", "winlog": { "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessGuid": "{5b522f6e-77ae-5eb1-2c03-000000000800}", "ProcessId": "6072", "Image": "C:\\Windows\\regedit.exe", "TargetObject": "HKU\\S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Key 2", "Details": "QWORD (0x00000000-0x00000005)", "RuleName": "-", "EventType": "SetValue", "UtcTime": "2020-05-05 14:57:44.714" }, "event_id": "13", "computer_name": "vagrant", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 2, "time_created": "2020-05-05T14:57:44.726Z", "level": "information", "process": { "pid": 5496, "thread": { "id": 876 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 2687, "opcode": "Info" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e13\u003c/EventID\u003e\u003cVersion\u003e2\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e13\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-05T14:57:44.726009900Z'/\u003e\u003cEventRecordID\u003e2687\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='5496' ThreadID='876'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e-\u003c/Data\u003e\u003cData Name='EventType'\u003eSetValue\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2020-05-05 14:57:44.714\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{5b522f6e-77ae-5eb1-2c03-000000000800}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e6072\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\regedit.exe\u003c/Data\u003e\u003cData Name='TargetObject'\u003eHKU\\S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Key 2\u003c/Data\u003e\u003cData Name='Details'\u003eQWORD (0x00000000-0x00000005)\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "13", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.692Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e13\u003c/EventID\u003e\u003cVersion\u003e2\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e13\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-05T14:57:46.818821400Z'/\u003e\u003cEventRecordID\u003e2690\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='5496' ThreadID='876'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e-\u003c/Data\u003e\u003cData Name='EventType'\u003eSetValue\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2020-05-05 14:57:46.808\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{5b522f6e-7554-5eb1-6d00-000000000800}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4320\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\Explorer.EXE\u003c/Data\u003e\u003cData Name='TargetObject'\u003eHKU\\S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\\ertrqvg.rkr\u003c/Data\u003e\u003cData Name='Details'\u003eBinary Data\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "13", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "record_id": 2690, "computer_name": "vagrant", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2020-05-05T14:57:46.818Z", "level": "information", "process": { "pid": 5496, "thread": { "id": 876 } }, "event_id": "13", "provider_name": "Microsoft-Windows-Sysmon", "version": 2, "user": { "identifier": "S-1-5-18" }, "event_data": { "TargetObject": "HKU\\S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\\ertrqvg.rkr", "Details": "Binary Data", "RuleName": "-", "EventType": "SetValue", "UtcTime": "2020-05-05 14:57:46.808", "ProcessGuid": "{5b522f6e-7554-5eb1-6d00-000000000800}", "ProcessId": "4320", "Image": "C:\\Windows\\Explorer.EXE" }, "channel": "Microsoft-Windows-Sysmon/Operational" } }, { "@timestamp": "2021-05-05T15:30:51.695Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029126300Z'/\u003e\u003cEventRecordID\u003e84\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.580\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eping.chartbeat.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "time_created": "2019-07-18T03:34:03.029Z", "level": "information", "event_data": { "UtcTime": "2019-07-18 03:34:02.580", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ping.chartbeat.net", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "record_id": 84, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5 } }, { "@timestamp": "2021-05-05T15:30:51.695Z", "winlog": { "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "time_created": "2019-07-18T03:34:03.029Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.628", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "clarium.freetls.fastly.net", "QueryStatus": "0" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 85, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029148500Z'/\u003e\u003cEventRecordID\u003e85\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.628\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eclarium.freetls.fastly.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.695Z", "winlog": { "event_id": "22", "record_id": 86, "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "process": { "thread": { "id": 1684 }, "pid": 2828 }, "event_data": { "QueryName": "nym1-ib.adnxs.com", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.633", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "version": 5, "time_created": "2019-07-18T03:34:03.029Z", "level": "information", "user": { "identifier": "S-1-5-18" } }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029159100Z'/\u003e\u003cEventRecordID\u003e86\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.633\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003enym1-ib.adnxs.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" } }, { "@timestamp": "2021-05-05T15:30:51.695Z", "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029240500Z'/\u003e\u003cEventRecordID\u003e87\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.716\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eeb2.3lift.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 us-east-eb2.3lift.com;type: 5 dualstack.engagement-bus-prod-713264365.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "winlog": { "computer_name": "vagrant-2016", "version": 5, "time_created": "2019-07-18T03:34:03.029Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessId": "2736", "QueryName": "eb2.3lift.com", "QueryStatus": "0", "QueryResults": "type: 5 us-east-eb2.3lift.com;type: 5 dualstack.engagement-bus-prod-713264365.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.716", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon", "event_id": "22", "record_id": 87, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational" } }, { "@timestamp": "2021-05-05T15:30:51.695Z", "event": { "code": "22", "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029251400Z'/\u003e\u003cEventRecordID\u003e88\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.727\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003epx.ads.linkedin.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 mix.linkedin.com;type: 5 any-na.mix.linkedin.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_id": "22", "computer_name": "vagrant-2016", "version": 5, "time_created": "2019-07-18T03:34:03.029Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 88, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "event_data": { "QueryName": "px.ads.linkedin.com", "QueryStatus": "0", "QueryResults": "type: 5 mix.linkedin.com;type: 5 any-na.mix.linkedin.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.727", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "process": { "pid": 2828, "thread": { "id": 1684 } } }, "agent": { "name": "mbp.local", "type": "filebeat", "version": "8.0.0", "ephemeral_id": "bdc6a4f9-ab87-41e0-a64e-bbcecdf73c6c", "id": "f0224db8-40a9-4f00-b117-333ddd1bc45b" } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "winlog": { "time_created": "2019-07-18T03:34:03.029Z", "event_data": { "QueryResults": "type: 5 login.msa.msidentity.com;type: 5 lgin.msa.trafficmanager.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.733", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "login.live.com", "QueryStatus": "0" }, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 89, "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "process": { "pid": 2828, "thread": { "id": 1684 } }, "user": { "identifier": "S-1-5-18" } }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029260200Z'/\u003e\u003cEventRecordID\u003e89\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.733\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003elogin.live.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 login.msa.msidentity.com;type: 5 lgin.msa.trafficmanager.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "event": { "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029315200Z'/\u003e\u003cEventRecordID\u003e90\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.792\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003edis.criteo.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;192.168.51.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "winlog": { "version": 5, "time_created": "2019-07-18T03:34:03.029Z", "level": "information", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 90, "computer_name": "vagrant-2016", "opcode": "Info", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "dis.criteo.com", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;192.168.51.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.792" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" }, "agent": { "id": "f0224db8-40a9-4f00-b117-333ddd1bc45b", "name": "mbp.local", "type": "filebeat", "version": "8.0.0", "ephemeral_id": "bdc6a4f9-ab87-41e0-a64e-bbcecdf73c6c" } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029331100Z'/\u003e\u003cEventRecordID\u003e91\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.792\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eib.adnxs.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 g.geogslb.com;type: 5 ib.anycast.adnxs.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event" }, "winlog": { "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "time_created": "2019-07-18T03:34:03.029Z", "user": { "identifier": "S-1-5-18" }, "provider_name": "Microsoft-Windows-Sysmon", "event_id": "22", "record_id": 91, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "event_data": { "QueryResults": "type: 5 g.geogslb.com;type: 5 ib.anycast.adnxs.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.792", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ib.adnxs.com", "QueryStatus": "0" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational" } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029339900Z'/\u003e\u003cEventRecordID\u003e92\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.809\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ecm.g.doubleclick.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 pagead.l.doubleclick.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22" }, "winlog": { "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.029Z", "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 92, "opcode": "Info", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryStatus": "0", "QueryResults": "type: 5 pagead.l.doubleclick.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.809", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "cm.g.doubleclick.net" }, "event_id": "22", "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029350100Z'/\u003e\u003cEventRecordID\u003e93\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.821\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ematch.adsrvr.org\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 match-975362022.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "version": 5, "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryStatus": "0", "QueryResults": "type: 5 match-975362022.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.821", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "match.adsrvr.org" }, "opcode": "Info", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 93, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.029Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029358900Z'/\u003e\u003cEventRecordID\u003e94\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.821\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003essum-sec.casalemedia.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 ssum-sec.casalemedia.com.edgekey.net;type: 5 e8037.g.akamaiedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_id": "22", "opcode": "Info", "time_created": "2019-07-18T03:34:03.029Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.821", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ssum-sec.casalemedia.com", "QueryStatus": "0", "QueryResults": "type: 5 ssum-sec.casalemedia.com.edgekey.net;type: 5 e8037.g.akamaiedge.net;::ffff:89.160.20.156;" }, "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 94, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5 } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029369500Z'/\u003e\u003cEventRecordID\u003e95\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.828\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eprotected-by.clarium.io\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 adserver-clarium-446793891.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" }, "winlog": { "event_id": "22", "record_id": 95, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2016", "version": 5, "time_created": "2019-07-18T03:34:03.029Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:02.828", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "protected-by.clarium.io", "QueryStatus": "0", "QueryResults": "type: 5 adserver-clarium-446793891.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029379000Z'/\u003e\u003cEventRecordID\u003e96\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.838\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003epagead2.googlesyndication.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 pagead46.l.doubleclick.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_id": "22", "record_id": 96, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:03.029Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:02.838", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "pagead2.googlesyndication.com", "QueryStatus": "0", "QueryResults": "type: 5 pagead46.l.doubleclick.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "log": { "level": "information" }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029388500Z'/\u003e\u003cEventRecordID\u003e97\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.839\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003egoogleads.g.doubleclick.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 pagead46.l.doubleclick.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "winlog": { "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 97, "computer_name": "vagrant-2016", "version": 5, "level": "information", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.029Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.839", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "googleads.g.doubleclick.net", "QueryStatus": "0", "QueryResults": "type: 5 pagead46.l.doubleclick.net;::ffff:89.160.20.156;" } } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029398800Z'/\u003e\u003cEventRecordID\u003e98\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.841\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003epixel.advertising.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 prod.ups-adcom.aolp-ds-prd.aws.oath.cloud;type: 5 prod.ups-us-east-1.aolp-ds-prd.aws.oath.cloud;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.029Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "pixel.advertising.com", "QueryStatus": "0", "QueryResults": "type: 5 prod.ups-adcom.aolp-ds-prd.aws.oath.cloud;type: 5 prod.ups-us-east-1.aolp-ds-prd.aws.oath.cloud;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.841" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "version": 5, "level": "information", "event_id": "22", "record_id": 98, "opcode": "Info" } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "winlog": { "event_data": { "QueryName": "onevideosync.uplynk.com", "QueryStatus": "0", "QueryResults": "type: 5 uplynk.adaptv.advertising.com;type: 5 uplynk-geo.adap.tv;type: 5 uplynk-beacon-newvpc-1603485991.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.844", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "opcode": "Info", "time_created": "2019-07-18T03:34:03.029Z", "user": { "identifier": "S-1-5-18" }, "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 99, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5 }, "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029408600Z'/\u003e\u003cEventRecordID\u003e99\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.844\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eonevideosync.uplynk.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 uplynk.adaptv.advertising.com;type: 5 uplynk-geo.adap.tv;type: 5 uplynk-beacon-newvpc-1603485991.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22" }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "winlog": { "record_id": 1, "computer_name": "vagrant-2012-r2", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 3, "time_created": "2019-03-18T16:57:37.933Z", "user": { "identifier": "S-1-5-21-3541430928-2051711210-1391384369-1001" }, "event_id": "16", "provider_name": "Microsoft-Windows-Sysmon", "event_data": { "UtcTime": "2019-03-18 16:57:37.933", "Configuration": "C:\\Users\\vagrant\\Downloads\\\"C:\\Users\\vagrant\\Downloads\\Sysmon.exe\" -i -n" }, "level": "information", "process": { "pid": 4616, "thread": { "id": 4724 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "opcode": "Info" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e16\u003c/EventID\u003e\u003cVersion\u003e3\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e16\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:37.933324000Z'/\u003e\u003cEventRecordID\u003e1\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4616' ThreadID='4724'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-3541430928-2051711210-1391384369-1001'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:37.933\u003c/Data\u003e\u003cData Name='Configuration'\u003eC:\\Users\\vagrant\\Downloads\\\"C:\\Users\\vagrant\\Downloads\\Sysmon.exe\" -i -n\u003c/Data\u003e\u003cData Name='ConfigurationFileHash'\u003e\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "16", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.697Z", "log": { "level": "information" }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.029416700Z'/\u003e\u003cEventRecordID\u003e100\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:02.956\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ead.turn.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 ad.turn.com.akadns.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "winlog": { "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "record_id": 100, "computer_name": "vagrant-2016", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "version": 5, "time_created": "2019-07-18T03:34:03.029Z", "level": "information", "event_data": { "ProcessId": "2736", "QueryName": "ad.turn.com", "QueryStatus": "0", "QueryResults": "type: 5 ad.turn.com.akadns.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:02.956", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.697Z", "log": { "level": "information" }, "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.611619700Z'/\u003e\u003cEventRecordID\u003e101\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.005\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eups.analytics.yahoo.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 prod.ups-yahoo.aolp-ds-prd.aws.oath.cloud;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22" }, "winlog": { "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "version": 5, "time_created": "2019-07-18T03:34:03.611Z", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "event_data": { "QueryResults": "type: 5 prod.ups-yahoo.aolp-ds-prd.aws.oath.cloud;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.005", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ups.analytics.yahoo.com", "QueryStatus": "0" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "record_id": 101 } }, { "@timestamp": "2021-05-05T15:30:51.697Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802369600Z'/\u003e\u003cEventRecordID\u003e102\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.070\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003epm.w55c.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "record_id": 102, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:03.802Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:03.070", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "pm.w55c.net", "QueryStatus": "0", "QueryResults": "type: 5 dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info" } }, { "@timestamp": "2021-05-05T15:30:51.697Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802391800Z'/\u003e\u003cEventRecordID\u003e103\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.093\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ecm.eyereturn.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;192.168.51.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.802Z", "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 103, "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_data": { "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;192.168.51.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.093", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "cm.eyereturn.com" } }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.697Z", "winlog": { "process": { "pid": 2828, "thread": { "id": 1684 } }, "opcode": "Info", "version": 5, "user": { "identifier": "S-1-5-18" }, "record_id": 104, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.802Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "event_data": { "QueryResults": "type: 5 pagead46.l.doubleclick.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.099", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "www.googletagservices.com", "QueryStatus": "0" } }, "log": { "level": "information" }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802402000Z'/\u003e\u003cEventRecordID\u003e104\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.099\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ewww.googletagservices.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 pagead46.l.doubleclick.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" } }, { "@timestamp": "2021-05-05T15:30:51.697Z", "winlog": { "event_data": { "UtcTime": "2019-07-18 03:34:03.107", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "cm.adgrx.com", "QueryStatus": "0", "QueryResults": "type: 5 rtb.adgrx.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "record_id": 105, "computer_name": "vagrant-2016", "opcode": "Info", "user": { "identifier": "S-1-5-18" }, "process": { "thread": { "id": 1684 }, "pid": 2828 }, "provider_name": "Microsoft-Windows-Sysmon", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:03.802Z", "level": "information" }, "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802413000Z'/\u003e\u003cEventRecordID\u003e105\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.107\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ecm.adgrx.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 rtb.adgrx.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.697Z", "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "version": 5, "time_created": "2019-07-18T03:34:03.802Z", "process": { "pid": 2828, "thread": { "id": 1684 } }, "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryStatus": "0", "QueryResults": "type: 5 j2waycm.netmng.com;type: 5 j2waycm-us-wdc.netmng.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.107", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "csm2waycm-atl.netmng.com" }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 106, "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802423900Z'/\u003e\u003cEventRecordID\u003e106\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.107\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ecsm2waycm-atl.netmng.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 j2waycm.netmng.com;type: 5 j2waycm-us-wdc.netmng.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e4\u003c/EventID\u003e\u003cVersion\u003e3\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e4\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:38.011477000Z'/\u003e\u003cEventRecordID\u003e2\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:38.011\u003c/Data\u003e\u003cData Name='State'\u003eStarted\u003c/Data\u003e\u003cData Name='Version'\u003e9.01\u003c/Data\u003e\u003cData Name='SchemaVersion'\u003e4.20\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "4", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "log": { "level": "information" }, "winlog": { "computer_name": "vagrant-2012-r2", "time_created": "2019-03-18T16:57:38.011Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "Version": "9.01", "SchemaVersion": "4.20", "UtcTime": "2019-03-18 16:57:38.011", "State": "Started" }, "process": { "pid": 4860, "thread": { "id": 4516 } }, "provider_name": "Microsoft-Windows-Sysmon", "event_id": "4", "record_id": 2, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 3, "channel": "Microsoft-Windows-Sysmon/Operational" } }, { "@timestamp": "2021-05-05T15:30:51.697Z", "winlog": { "record_id": 107, "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:03.802Z", "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "level": "information", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "event_data": { "QueryName": "pr-bh.ybp.yahoo.com", "QueryStatus": "0", "QueryResults": "type: 5 ds-pr-bh.ybp.gysm.yahoodns.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.112", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802433000Z'/\u003e\u003cEventRecordID\u003e107\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.112\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003epr-bh.ybp.yahoo.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 ds-pr-bh.ybp.gysm.yahoodns.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.698Z", "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802441200Z'/\u003e\u003cEventRecordID\u003e108\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.113\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eps.eyeota.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" }, "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "record_id": 108, "opcode": "Info", "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "version": 5, "time_created": "2019-07-18T03:34:03.802Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.113", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ps.eyeota.net" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "winlog": { "event_id": "1", "level": "information", "computer_name": "vagrant-2012-r2", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-03-18T16:57:38.011Z", "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 3, "user": { "identifier": "S-1-5-18" }, "event_data": { "Hashes": "SHA1=AC93C3B38E57A2715572933DBCB2A1C2892DBC5E", "UtcTime": "2019-03-18 16:57:37.949", "ProcessGuid": "{42f11c3b-ce01-5c8f-0000-0010c73e2a00}", "Product": "Sysinternals Sysmon", "Company": "Sysinternals - www.sysinternals.com", "LogonId": "0x3e7", "ParentCommandLine": "C:\\Windows\\system32\\services.exe", "CommandLine": "C:\\Windows\\Sysmon.exe", "CurrentDirectory": "C:\\Windows\\system32\\", "LogonGuid": "{42f11c3b-6e1a-5c8c-0000-0020e7030000}", "TerminalSessionId": "0", "ParentImage": "C:\\Windows\\System32\\services.exe", "ProcessId": "4860", "ParentProcessId": "488", "ParentProcessGuid": "{42f11c3b-6e1a-5c8c-0000-0010f14d0000}", "Image": "C:\\Windows\\Sysmon.exe", "FileVersion": "9.01", "Description": "System activity monitor", "User": "NT AUTHORITY\\SYSTEM", "IntegrityLevel": "System" }, "process": { "pid": 4860, "thread": { "id": 4516 } } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e1\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e1\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:38.011477000Z'/\u003e\u003cEventRecordID\u003e3\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:37.949\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-ce01-5c8f-0000-0010c73e2a00}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4860\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\Sysmon.exe\u003c/Data\u003e\u003cData Name='FileVersion'\u003e9.01\u003c/Data\u003e\u003cData Name='Description'\u003eSystem activity monitor\u003c/Data\u003e\u003cData Name='Product'\u003eSysinternals Sysmon\u003c/Data\u003e\u003cData Name='Company'\u003eSysinternals - www.sysinternals.com\u003c/Data\u003e\u003cData Name='CommandLine'\u003eC:\\Windows\\Sysmon.exe\u003c/Data\u003e\u003cData Name='CurrentDirectory'\u003eC:\\Windows\\system32\\\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\SYSTEM\u003c/Data\u003e\u003cData Name='LogonGuid'\u003e{42f11c3b-6e1a-5c8c-0000-0020e7030000}\u003c/Data\u003e\u003cData Name='LogonId'\u003e0x3e7\u003c/Data\u003e\u003cData Name='TerminalSessionId'\u003e0\u003c/Data\u003e\u003cData Name='IntegrityLevel'\u003eSystem\u003c/Data\u003e\u003cData Name='Hashes'\u003eSHA1=AC93C3B38E57A2715572933DBCB2A1C2892DBC5E\u003c/Data\u003e\u003cData Name='ParentProcessGuid'\u003e{42f11c3b-6e1a-5c8c-0000-0010f14d0000}\u003c/Data\u003e\u003cData Name='ParentProcessId'\u003e488\u003c/Data\u003e\u003cData Name='ParentImage'\u003eC:\\Windows\\System32\\services.exe\u003c/Data\u003e\u003cData Name='ParentCommandLine'\u003eC:\\Windows\\system32\\services.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "1", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.698Z", "log": { "level": "information" }, "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802456000Z'/\u003e\u003cEventRecordID\u003e109\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.146\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eidpix.media6degrees.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 idpix.media6degrees.com.cdn.cloudflare.net;type: 5 map.media6degrees.com;type: 5 map.media6degrees.com.cdn.cloudflare.net;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22" }, "winlog": { "time_created": "2019-07-18T03:34:03.802Z", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 109, "opcode": "Info", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryName": "idpix.media6degrees.com", "QueryStatus": "0", "QueryResults": "type: 5 idpix.media6degrees.com.cdn.cloudflare.net;type: 5 map.media6degrees.com;type: 5 map.media6degrees.com.cdn.cloudflare.net;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.146", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" }, "agent": { "name": "mbp.local", "type": "filebeat", "version": "8.0.0", "ephemeral_id": "bdc6a4f9-ab87-41e0-a64e-bbcecdf73c6c", "id": "f0224db8-40a9-4f00-b117-333ddd1bc45b" } }, { "@timestamp": "2021-05-05T15:30:51.698Z", "event": { "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802466200Z'/\u003e\u003cEventRecordID\u003e110\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.146\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003etpc.googlesyndication.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 pagead-googlehosted.l.google.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "log": { "level": "information" }, "winlog": { "level": "information", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "version": 5, "time_created": "2019-07-18T03:34:03.802Z", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "event_data": { "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "tpc.googlesyndication.com", "QueryStatus": "0", "QueryResults": "type: 5 pagead-googlehosted.l.google.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.146" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "record_id": 110, "computer_name": "vagrant-2016" } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e1\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e1\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:38.011477000Z'/\u003e\u003cEventRecordID\u003e4\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:37.964\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-ce01-5c8f-0000-00102c412a00}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e5028\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\wbem\\unsecapp.exe\u003c/Data\u003e\u003cData Name='FileVersion'\u003e6.3.9600.16384 (winblue_rtm.130821-1623)\u003c/Data\u003e\u003cData Name='Description'\u003eSink to receive asynchronous callbacks for WMI client application\u003c/Data\u003e\u003cData Name='Product'\u003eMicrosoft« Windows« Operating System\u003c/Data\u003e\u003cData Name='Company'\u003eMicrosoft Corporation\u003c/Data\u003e\u003cData Name='CommandLine'\u003eC:\\Windows\\system32\\wbem\\unsecapp.exe -Embedding\u003c/Data\u003e\u003cData Name='CurrentDirectory'\u003eC:\\Windows\\system32\\\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\SYSTEM\u003c/Data\u003e\u003cData Name='LogonGuid'\u003e{42f11c3b-6e1a-5c8c-0000-0020e7030000}\u003c/Data\u003e\u003cData Name='LogonId'\u003e0x3e7\u003c/Data\u003e\u003cData Name='TerminalSessionId'\u003e0\u003c/Data\u003e\u003cData Name='IntegrityLevel'\u003eSystem\u003c/Data\u003e\u003cData Name='Hashes'\u003eSHA1=6DF8163A6320B80B60733F9D62E2F39B4B16B678\u003c/Data\u003e\u003cData Name='ParentProcessGuid'\u003e{42f11c3b-6e1b-5c8c-0000-00102f610000}\u003c/Data\u003e\u003cData Name='ParentProcessId'\u003e560\u003c/Data\u003e\u003cData Name='ParentImage'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003cData Name='ParentCommandLine'\u003eC:\\Windows\\system32\\svchost.exe -k DcomLaunch\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "1" }, "winlog": { "record_id": 4, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-03-18T16:57:38.011Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "event_data": { "ProcessGuid": "{42f11c3b-ce01-5c8f-0000-00102c412a00}", "Description": "Sink to receive asynchronous callbacks for WMI client application", "Company": "Microsoft Corporation", "LogonId": "0x3e7", "ParentProcessId": "560", "ParentImage": "C:\\Windows\\System32\\svchost.exe", "ParentCommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch", "Product": "Microsoft« Windows« Operating System", "User": "NT AUTHORITY\\SYSTEM", "LogonGuid": "{42f11c3b-6e1a-5c8c-0000-0020e7030000}", "Image": "C:\\Windows\\System32\\wbem\\unsecapp.exe", "FileVersion": "6.3.9600.16384 (winblue_rtm.130821-1623)", "CommandLine": "C:\\Windows\\system32\\wbem\\unsecapp.exe -Embedding", "TerminalSessionId": "0", "IntegrityLevel": "System", "Hashes": "SHA1=6DF8163A6320B80B60733F9D62E2F39B4B16B678", "UtcTime": "2019-03-18 16:57:37.964", "ProcessId": "5028", "CurrentDirectory": "C:\\Windows\\system32\\", "ParentProcessGuid": "{42f11c3b-6e1b-5c8c-0000-00102f610000}" }, "process": { "pid": 4860, "thread": { "id": 4516 } }, "user": { "identifier": "S-1-5-18" }, "event_id": "1", "computer_name": "vagrant-2012-r2" }, "host": { "name": "vagrant-2012-r2" } }, { "@timestamp": "2021-05-05T15:30:51.698Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802480600Z'/\u003e\u003cEventRecordID\u003e111\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.182\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eimage2.pubmatic.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 pug44000nfc.pubmatic.com;type: 5 pug44000nf.pubmatic.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event" }, "log": { "level": "information" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:03.802Z", "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.182", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "image2.pubmatic.com", "QueryStatus": "0", "QueryResults": "type: 5 pug44000nfc.pubmatic.com;type: 5 pug44000nf.pubmatic.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;" }, "process": { "thread": { "id": 1684 }, "pid": 2828 }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 111, "computer_name": "vagrant-2016", "level": "information", "user": { "identifier": "S-1-5-18" } } }, { "@timestamp": "2021-05-05T15:30:51.698Z", "log": { "level": "information" }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802496100Z'/\u003e\u003cEventRecordID\u003e112\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.183\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003esam.msn.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 www.msn.com;type: 5 www-msn-com.a-0003.a-msedge.net;type: 5 a-0003.a-msedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "winlog": { "version": 5, "time_created": "2019-07-18T03:34:03.802Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 112, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "event_id": "22", "computer_name": "vagrant-2016", "event_data": { "ProcessId": "2736", "QueryName": "sam.msn.com", "QueryStatus": "0", "QueryResults": "type: 5 www.msn.com;type: 5 www-msn-com.a-0003.a-msedge.net;type: 5 a-0003.a-msedge.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.183", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.698Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802516200Z'/\u003e\u003cEventRecordID\u003e113\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.222\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eocsp.sca1b.amazontrust.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "time_created": "2019-07-18T03:34:03.802Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 113, "opcode": "Info", "version": 5, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "event_data": { "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.222", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ocsp.sca1b.amazontrust.com", "QueryStatus": "0" } } }, { "@timestamp": "2021-05-05T15:30:51.698Z", "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802540200Z'/\u003e\u003cEventRecordID\u003e114\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.271\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ec1.adform.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 track.adformnet.akadns.net;type: 5 track-us.adformnet.akadns.net;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "log": { "level": "information" }, "winlog": { "version": 5, "time_created": "2019-07-18T03:34:03.802Z", "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 114, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "computer_name": "vagrant-2016", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessId": "2736", "QueryName": "c1.adform.net", "QueryStatus": "0", "QueryResults": "type: 5 track.adformnet.akadns.net;type: 5 track-us.adformnet.akadns.net;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.271", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" } } }, { "@timestamp": "2021-05-05T15:30:51.699Z", "winlog": { "version": 5, "event_data": { "QueryName": "urs.microsoft.com", "QueryStatus": "0", "QueryResults": "type: 5 wd-prod-ss.trafficmanager.net;type: 5 wd-prod-ss-us-southcentral-2-fe.southcentralus.cloudapp.azure.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.271", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 115, "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "channel": "Microsoft-Windows-Sysmon/Operational", "time_created": "2019-07-18T03:34:03.802Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } } }, "event": { "provider": "Microsoft-Windows-Sysmon", "code": "22", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802550800Z'/\u003e\u003cEventRecordID\u003e115\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.271\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eurs.microsoft.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 wd-prod-ss.trafficmanager.net;type: 5 wd-prod-ss-us-southcentral-2-fe.southcentralus.cloudapp.azure.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event" }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.699Z", "winlog": { "opcode": "Info", "version": 5, "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.802Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "dsum-sec.casalemedia.com", "QueryStatus": "0", "QueryResults": "type: 5 dsum-sec.casalemedia.com.edgekey.net;type: 5 e8037.g.akamaiedge.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.290" }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 116 }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802560700Z'/\u003e\u003cEventRecordID\u003e116\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.290\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003edsum-sec.casalemedia.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 dsum-sec.casalemedia.com.edgekey.net;type: 5 e8037.g.akamaiedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.699Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802569800Z'/\u003e\u003cEventRecordID\u003e117\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.292\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eocsp.godaddy.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 ocsp.godaddy.com.akadns.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "user": { "identifier": "S-1-5-18" }, "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.292", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ocsp.godaddy.com", "QueryStatus": "0", "QueryResults": "type: 5 ocsp.godaddy.com.akadns.net;::ffff:89.160.20.156;" }, "computer_name": "vagrant-2016", "version": 5, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 117, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.802Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "process": { "pid": 2828, "thread": { "id": 1684 } } }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.699Z", "winlog": { "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:03.315", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "googleads.g.doubleclick.net", "QueryStatus": "9701", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "process": { "thread": { "id": 1684 }, "pid": 2828 }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "time_created": "2019-07-18T03:34:03.802Z", "level": "information", "event_id": "22", "record_id": 118, "opcode": "Info" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802587100Z'/\u003e\u003cEventRecordID\u003e118\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.315\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003egoogleads.g.doubleclick.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e9701\u003c/Data\u003e\u003cData Name='QueryResults'\u003e\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.699Z", "winlog": { "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.802Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:03.315", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "tpc.googlesyndication.com", "QueryStatus": "9701", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "version": 5, "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 119 }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802678700Z'/\u003e\u003cEventRecordID\u003e119\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.315\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003etpc.googlesyndication.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e9701\u003c/Data\u003e\u003cData Name='QueryResults'\u003e\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.697Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e5\u003c/EventID\u003e\u003cVersion\u003e3\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e5\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:38.981137800Z'/\u003e\u003cEventRecordID\u003e5\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:38.981\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-cdf4-5c8f-0000-0010e61e2a00}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4616\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Users\\vagrant\\AppData\\Local\\Temp\\Sysmon.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "5" }, "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2012-r2", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 3, "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "5", "record_id": 5, "opcode": "Info", "time_created": "2019-03-18T16:57:38.981Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "Image": "C:\\Users\\vagrant\\AppData\\Local\\Temp\\Sysmon.exe", "UtcTime": "2019-03-18 16:57:38.981", "ProcessGuid": "{42f11c3b-cdf4-5c8f-0000-0010e61e2a00}", "ProcessId": "4616" }, "process": { "pid": 4860, "thread": { "id": 4516 } } } }, { "@timestamp": "2021-05-05T15:30:51.699Z", "winlog": { "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 120, "computer_name": "vagrant-2016", "opcode": "Info", "time_created": "2019-07-18T03:34:03.802Z", "event_data": { "UtcTime": "2019-07-18 03:34:03.333", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ocsp.usertrust.com", "QueryStatus": "0", "QueryResults": "type: 5 t3j2g9x7.stackpathcdn.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802700200Z'/\u003e\u003cEventRecordID\u003e120\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.333\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eocsp.usertrust.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 t3j2g9x7.stackpathcdn.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.699Z", "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2016", "version": 5, "event_data": { "QueryStatus": "0", "QueryResults": "type: 5 isrg.trustid.ocsp.identrust.com.edgesuite.net;type: 5 a279.dscq.akamai.net;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.343", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "isrg.trustid.ocsp.identrust.com" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 121, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.802Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802715400Z'/\u003e\u003cEventRecordID\u003e121\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.343\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eisrg.trustid.ocsp.identrust.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 isrg.trustid.ocsp.identrust.com.edgesuite.net;type: 5 a279.dscq.akamai.net;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.699Z", "winlog": { "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 122, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.802Z", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "opcode": "Info", "version": 5, "level": "information", "event_data": { "QueryStatus": "0", "QueryResults": "type: 5 dart.l.doubleclick.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.391", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ad.doubleclick.net" }, "computer_name": "vagrant-2016" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802729100Z'/\u003e\u003cEventRecordID\u003e122\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.391\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ead.doubleclick.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 dart.l.doubleclick.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.698Z", "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e5\u003c/EventID\u003e\u003cVersion\u003e3\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e5\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:38.981137800Z'/\u003e\u003cEventRecordID\u003e6\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:38.981\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-cdf4-5c8f-0000-0010071e2a00}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4648\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Users\\vagrant\\Downloads\\Sysmon.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "5", "kind": "event" }, "winlog": { "user": { "identifier": "S-1-5-18" }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 6, "computer_name": "vagrant-2012-r2", "opcode": "Info", "time_created": "2019-03-18T16:57:38.981Z", "event_data": { "ProcessGuid": "{42f11c3b-cdf4-5c8f-0000-0010071e2a00}", "ProcessId": "4648", "Image": "C:\\Users\\vagrant\\Downloads\\Sysmon.exe", "UtcTime": "2019-03-18 16:57:38.981" }, "process": { "pid": 4860, "thread": { "id": 4516 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "5", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 3, "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.700Z", "winlog": { "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:03.393", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ocsp.sectigo.com", "QueryStatus": "0", "QueryResults": "type: 5 t3j2g9x7.stackpathcdn.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 123, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.802Z" }, "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802739000Z'/\u003e\u003cEventRecordID\u003e123\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.393\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eocsp.sectigo.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 t3j2g9x7.stackpathcdn.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.698Z", "log": { "level": "information" }, "event": { "code": "1", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e1\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e1\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:39.012744700Z'/\u003e\u003cEventRecordID\u003e7\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:39.012\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-ce03-5c8f-0000-0010e9462a00}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4508\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\wbem\\WmiPrvSE.exe\u003c/Data\u003e\u003cData Name='FileVersion'\u003e6.3.9600.16384 (winblue_rtm.130821-1623)\u003c/Data\u003e\u003cData Name='Description'\u003eWMI Provider Host\u003c/Data\u003e\u003cData Name='Product'\u003eMicrosoft« Windows« Operating System\u003c/Data\u003e\u003cData Name='Company'\u003eMicrosoft Corporation\u003c/Data\u003e\u003cData Name='CommandLine'\u003eC:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding\u003c/Data\u003e\u003cData Name='CurrentDirectory'\u003eC:\\Windows\\system32\\\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\SYSTEM\u003c/Data\u003e\u003cData Name='LogonGuid'\u003e{42f11c3b-6e1a-5c8c-0000-0020e7030000}\u003c/Data\u003e\u003cData Name='LogonId'\u003e0x3e7\u003c/Data\u003e\u003cData Name='TerminalSessionId'\u003e0\u003c/Data\u003e\u003cData Name='IntegrityLevel'\u003eSystem\u003c/Data\u003e\u003cData Name='Hashes'\u003eSHA1=5A4C0E82FF95C9FB762D46A696EF9F1B68001C21\u003c/Data\u003e\u003cData Name='ParentProcessGuid'\u003e{42f11c3b-6e1b-5c8c-0000-00102f610000}\u003c/Data\u003e\u003cData Name='ParentProcessId'\u003e560\u003c/Data\u003e\u003cData Name='ParentImage'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003cData Name='ParentCommandLine'\u003eC:\\Windows\\system32\\svchost.exe -k DcomLaunch\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2012-r2", "opcode": "Info", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "1", "process": { "pid": 4860, "thread": { "id": 4516 } }, "time_created": "2019-03-18T16:57:39.012Z", "event_data": { "Product": "Microsoft« Windows« Operating System", "Company": "Microsoft Corporation", "CurrentDirectory": "C:\\Windows\\system32\\", "ParentProcessId": "560", "ParentCommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch", "ProcessId": "4508", "Description": "WMI Provider Host", "Image": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", "FileVersion": "6.3.9600.16384 (winblue_rtm.130821-1623)", "User": "NT AUTHORITY\\SYSTEM", "LogonGuid": "{42f11c3b-6e1a-5c8c-0000-0020e7030000}", "TerminalSessionId": "0", "IntegrityLevel": "System", "UtcTime": "2019-03-18 16:57:39.012", "ProcessGuid": "{42f11c3b-ce03-5c8f-0000-0010e9462a00}", "ParentImage": "C:\\Windows\\System32\\svchost.exe", "Hashes": "SHA1=5A4C0E82FF95C9FB762D46A696EF9F1B68001C21", "ParentProcessGuid": "{42f11c3b-6e1b-5c8c-0000-00102f610000}", "CommandLine": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding", "LogonId": "0x3e7" }, "record_id": 7, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" } }, { "@timestamp": "2021-05-05T15:30:51.699Z", "winlog": { "event_id": "3", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2012-r2", "version": 5, "time_created": "2019-03-18T16:57:49.089Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "DestinationPort": "53", "ProcessGuid": "{42f11c3b-0bad-5c8c-0000-0010dfbc0000}", "User": "NT AUTHORITY\\NETWORK SERVICE", "SourceIsIpv6": "true", "SourceIp": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", "DestinationPortName": "domain", "DestinationIsIpv6": "true", "UtcTime": "2019-03-18 16:57:47.847", "ProcessId": "924", "Initiated": "true", "SourcePort": "62141", "Image": "C:\\Windows\\System32\\svchost.exe", "Protocol": "udp", "DestinationIp": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" }, "channel": "Microsoft-Windows-Sysmon/Operational", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "process": { "pid": 4860, "thread": { "id": 4492 } }, "record_id": 8 }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:49.089723100Z'/\u003e\u003cEventRecordID\u003e8\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:47.847\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-0bad-5c8c-0000-0010dfbc0000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e924\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\NETWORK SERVICE\u003c/Data\u003e\u003cData Name='Protocol'\u003eudp\u003c/Data\u003e\u003cData Name='Initiated'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIp'\u003e2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\u003c/Data\u003e\u003cData Name='SourceHostname'\u003e\u003c/Data\u003e\u003cData Name='SourcePort'\u003e62141\u003c/Data\u003e\u003cData Name='SourcePortName'\u003e\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003etrue\u003c/Data\u003e\u003cData Name='DestinationIp'\u003e2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e53\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003edomain\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "3", "kind": "event" }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.700Z", "log": { "level": "information" }, "event": { "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:49.089723100Z'/\u003e\u003cEventRecordID\u003e9\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:48.070\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-0bad-5c8c-0000-0010dfbc0000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e924\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\NETWORK SERVICE\u003c/Data\u003e\u003cData Name='Protocol'\u003eudp\u003c/Data\u003e\u003cData Name='Initiated'\u003efalse\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='SourceIp'\u003e10.0.2.15\u003c/Data\u003e\u003cData Name='SourceHostname'\u003evagrant-2012-r2.local.crowbird.com\u003c/Data\u003e\u003cData Name='SourcePort'\u003e62141\u003c/Data\u003e\u003cData Name='SourcePortName'\u003e\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='DestinationIp'\u003e10.0.2.3\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e53\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003edomain\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "3" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "3", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "time_created": "2019-03-18T16:57:49.089Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessGuid": "{42f11c3b-0bad-5c8c-0000-0010dfbc0000}", "ProcessId": "924", "Protocol": "udp", "DestinationPortName": "domain", "UtcTime": "2019-03-18 16:57:48.070", "SourceIsIpv6": "false", "SourceHostname": "vagrant-2012-r2.local.crowbird.com", "SourcePort": "62141", "DestinationIp": "10.0.2.3", "DestinationPort": "53", "Image": "C:\\Windows\\System32\\svchost.exe", "User": "NT AUTHORITY\\NETWORK SERVICE", "Initiated": "false", "SourceIp": "10.0.2.15", "DestinationIsIpv6": "false" }, "record_id": 9, "computer_name": "vagrant-2012-r2", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "process": { "pid": 4860, "thread": { "id": 4492 } } } }, { "@timestamp": "2021-05-05T15:30:51.700Z", "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:49.340580700Z'/\u003e\u003cEventRecordID\u003e10\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:48.148\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-ccaa-5c8f-0000-0010b4e22700}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e1600\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\u003c/Data\u003e\u003cData Name='User'\u003eVAGRANT-2012-R2\\vagrant\u003c/Data\u003e\u003cData Name='Protocol'\u003etcp\u003c/Data\u003e\u003cData Name='Initiated'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='SourceIp'\u003e10.0.2.15\u003c/Data\u003e\u003cData Name='SourceHostname'\u003evagrant-2012-r2.local.crowbird.com\u003c/Data\u003e\u003cData Name='SourcePort'\u003e1138\u003c/Data\u003e\u003cData Name='SourcePortName'\u003e\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='DestinationIp'\u003e89.160.20.156\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e443\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003ehttps\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "3", "kind": "event" }, "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "version": 5, "time_created": "2019-03-18T16:57:49.340Z", "level": "information", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "event_data": { "SourceIsIpv6": "false", "DestinationIsIpv6": "false", "DestinationPort": "443", "DestinationPortName": "https", "User": "VAGRANT-2012-R2\\vagrant", "Protocol": "tcp", "SourceIp": "10.0.2.15", "SourcePort": "1138", "UtcTime": "2019-03-18 16:57:48.148", "ProcessGuid": "{42f11c3b-ccaa-5c8f-0000-0010b4e22700}", "ProcessId": "1600", "Image": "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe", "Initiated": "true", "DestinationIp": "89.160.20.156", "SourceHostname": "vagrant-2012-r2.local.crowbird.com" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "3", "record_id": 10, "computer_name": "vagrant-2012-r2", "process": { "pid": 4860, "thread": { "id": 4492 } } }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.700Z", "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:49.340580700Z'/\u003e\u003cEventRecordID\u003e11\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:48.214\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-ccaa-5c8f-0000-0010b4e22700}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e1600\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\u003c/Data\u003e\u003cData Name='User'\u003eVAGRANT-2012-R2\\vagrant\u003c/Data\u003e\u003cData Name='Protocol'\u003etcp\u003c/Data\u003e\u003cData Name='Initiated'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='SourceIp'\u003e10.0.2.15\u003c/Data\u003e\u003cData Name='SourceHostname'\u003evagrant-2012-r2.local.crowbird.com\u003c/Data\u003e\u003cData Name='SourcePort'\u003e1139\u003c/Data\u003e\u003cData Name='SourcePortName'\u003e\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='DestinationIp'\u003e89.160.20.156\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e443\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003ehttps\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "3", "kind": "event" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "3", "computer_name": "vagrant-2012-r2", "version": 5, "time_created": "2019-03-18T16:57:49.340Z", "process": { "pid": 4860, "thread": { "id": 4492 } }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 11, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "Protocol": "tcp", "DestinationIsIpv6": "false", "SourceIp": "10.0.2.15", "SourceHostname": "vagrant-2012-r2.local.crowbird.com", "ProcessId": "1600", "User": "VAGRANT-2012-R2\\vagrant", "Initiated": "true", "DestinationPortName": "https", "Image": "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe", "SourceIsIpv6": "false", "SourcePort": "1139", "DestinationIp": "89.160.20.156", "DestinationPort": "443", "UtcTime": "2019-03-18 16:57:48.214", "ProcessGuid": "{42f11c3b-ccaa-5c8f-0000-0010b4e22700}" } } }, { "@timestamp": "2021-05-05T15:30:51.700Z", "winlog": { "event_id": "22", "version": 5, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 124, "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.802Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryName": "ocsp.int-x3.letsencrypt.org", "QueryStatus": "0", "QueryResults": "type: 5 ocsp.int-x3.letsencrypt.org.edgesuite.net;type: 5 a771.dscq.akamai.net;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.468", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "process": { "pid": 2828, "thread": { "id": 1684 } } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802753800Z'/\u003e\u003cEventRecordID\u003e124\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.468\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eocsp.int-x3.letsencrypt.org\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 ocsp.int-x3.letsencrypt.org.edgesuite.net;type: 5 a771.dscq.akamai.net;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.700Z", "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:03.802768300Z'/\u003e\u003cEventRecordID\u003e125\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.581\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eocsp.pki.goog\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 pki-goog.l.google.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:03.802Z", "user": { "identifier": "S-1-5-18" }, "process": { "thread": { "id": 1684 }, "pid": 2828 }, "event_data": { "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ocsp.pki.goog", "QueryStatus": "0", "QueryResults": "type: 5 pki-goog.l.google.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.581" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 125, "opcode": "Info", "version": 5, "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.700Z", "winlog": { "opcode": "Info", "version": 5, "time_created": "2019-03-18T16:57:49.340Z", "level": "information", "event_id": "3", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2012-r2", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessId": "4", "Image": "System", "DestinationPortName": "netbios-ns", "SourceIsIpv6": "false", "DestinationIp": "10.0.2.255", "ProcessGuid": "{42f11c3b-6e19-5c8c-0000-0010eb030000}", "Initiated": "true", "SourceIp": "10.0.2.15", "SourcePortName": "netbios-ns", "DestinationPort": "137", "DestinationIsIpv6": "false", "UtcTime": "2019-03-18 16:57:48.250", "User": "NT AUTHORITY\\SYSTEM", "Protocol": "udp", "SourceHostname": "vagrant-2012-r2.local.crowbird.com", "SourcePort": "137" }, "process": { "pid": 4860, "thread": { "id": 4492 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 12 }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:49.340580700Z'/\u003e\u003cEventRecordID\u003e12\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:48.250\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-6e19-5c8c-0000-0010eb030000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4\u003c/Data\u003e\u003cData Name='Image'\u003eSystem\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\SYSTEM\u003c/Data\u003e\u003cData Name='Protocol'\u003eudp\u003c/Data\u003e\u003cData Name='Initiated'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='SourceIp'\u003e10.0.2.15\u003c/Data\u003e\u003cData Name='SourceHostname'\u003evagrant-2012-r2.local.crowbird.com\u003c/Data\u003e\u003cData Name='SourcePort'\u003e137\u003c/Data\u003e\u003cData Name='SourcePortName'\u003enetbios-ns\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='DestinationIp'\u003e10.0.2.255\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e137\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003enetbios-ns\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "3", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.700Z", "winlog": { "user": { "identifier": "S-1-5-18" }, "record_id": 126, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:04.029Z", "level": "information", "event_data": { "ProcessId": "2736", "QueryName": "googleads4.g.doubleclick.net", "QueryStatus": "0", "QueryResults": "type: 5 pagead.l.doubleclick.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.872", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "opcode": "Info" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.029828800Z'/\u003e\u003cEventRecordID\u003e126\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.872\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003egoogleads4.g.doubleclick.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 pagead.l.doubleclick.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.701Z", "log": { "level": "information" }, "event": { "code": "3", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:49.340580700Z'/\u003e\u003cEventRecordID\u003e13\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:48.250\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-6e19-5c8c-0000-0010eb030000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4\u003c/Data\u003e\u003cData Name='Image'\u003eSystem\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\SYSTEM\u003c/Data\u003e\u003cData Name='Protocol'\u003eudp\u003c/Data\u003e\u003cData Name='Initiated'\u003efalse\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='SourceIp'\u003e10.0.2.255\u003c/Data\u003e\u003cData Name='SourceHostname'\u003e\u003c/Data\u003e\u003cData Name='SourcePort'\u003e137\u003c/Data\u003e\u003cData Name='SourcePortName'\u003enetbios-ns\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='DestinationIp'\u003e10.0.2.15\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003evagrant-2012-r2.local.crowbird.com\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e137\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003enetbios-ns\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "user": { "identifier": "S-1-5-18" }, "process": { "pid": 4860, "thread": { "id": 4492 } }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 13, "computer_name": "vagrant-2012-r2", "level": "information", "version": 5, "time_created": "2019-03-18T16:57:49.340Z", "event_data": { "ProcessId": "4", "Image": "System", "Protocol": "udp", "DestinationHostname": "vagrant-2012-r2.local.crowbird.com", "DestinationPortName": "netbios-ns", "UtcTime": "2019-03-18 16:57:48.250", "SourceIsIpv6": "false", "SourceIp": "10.0.2.255", "DestinationIp": "10.0.2.15", "User": "NT AUTHORITY\\SYSTEM", "Initiated": "false", "DestinationPort": "137", "ProcessGuid": "{42f11c3b-6e19-5c8c-0000-0010eb030000}", "SourcePort": "137", "SourcePortName": "netbios-ns", "DestinationIsIpv6": "false" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "3", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" }, "agent": { "id": "f0224db8-40a9-4f00-b117-333ddd1bc45b", "name": "mbp.local", "type": "filebeat", "version": "8.0.0", "ephemeral_id": "bdc6a4f9-ab87-41e0-a64e-bbcecdf73c6c" } }, { "@timestamp": "2021-05-05T15:30:51.700Z", "log": { "level": "information" }, "winlog": { "time_created": "2019-07-18T03:34:04.029Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:03.889", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "images.taboola.com", "QueryStatus": "0", "QueryResults": "type: 5 f2.taboola.map.fastly.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 127, "computer_name": "vagrant-2016", "opcode": "Info", "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5 }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.029851300Z'/\u003e\u003cEventRecordID\u003e127\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.889\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eimages.taboola.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 f2.taboola.map.fastly.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" } }, { "@timestamp": "2021-05-05T15:30:51.701Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:49.340580700Z'/\u003e\u003cEventRecordID\u003e14\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:48.250\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-0bad-5c8c-0000-0010dfbc0000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e924\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\NETWORK SERVICE\u003c/Data\u003e\u003cData Name='Protocol'\u003eudp\u003c/Data\u003e\u003cData Name='Initiated'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIp'\u003efe80:0:0:0:e488:b85c:5262:ff86\u003c/Data\u003e\u003cData Name='SourceHostname'\u003evagrant-2012-r2.local.crowbird.com\u003c/Data\u003e\u003cData Name='SourcePort'\u003e55542\u003c/Data\u003e\u003cData Name='SourcePortName'\u003e\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003etrue\u003c/Data\u003e\u003cData Name='DestinationIp'\u003eff02:0:0:0:0:0:1:3\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e5355\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003ellmnr\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "3" }, "winlog": { "event_data": { "Initiated": "true", "SourceIsIpv6": "true", "SourceIp": "fe80:0:0:0:e488:b85c:5262:ff86", "SourceHostname": "vagrant-2012-r2.local.crowbird.com", "Image": "C:\\Windows\\System32\\svchost.exe", "Protocol": "udp", "SourcePort": "55542", "DestinationIsIpv6": "true", "DestinationPort": "5355", "DestinationPortName": "llmnr", "ProcessGuid": "{42f11c3b-0bad-5c8c-0000-0010dfbc0000}", "ProcessId": "924", "DestinationIp": "ff02:0:0:0:0:0:1:3", "UtcTime": "2019-03-18 16:57:48.250", "User": "NT AUTHORITY\\NETWORK SERVICE" }, "process": { "pid": 4860, "thread": { "id": 4492 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "3", "version": 5, "time_created": "2019-03-18T16:57:49.340Z", "user": { "identifier": "S-1-5-18" }, "level": "information", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 14, "computer_name": "vagrant-2012-r2", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.701Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:49.340580700Z'/\u003e\u003cEventRecordID\u003e15\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:48.250\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-0bad-5c8c-0000-0010dfbc0000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e924\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\NETWORK SERVICE\u003c/Data\u003e\u003cData Name='Protocol'\u003eudp\u003c/Data\u003e\u003cData Name='Initiated'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIp'\u003e2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\u003c/Data\u003e\u003cData Name='SourceHostname'\u003e\u003c/Data\u003e\u003cData Name='SourcePort'\u003e55542\u003c/Data\u003e\u003cData Name='SourcePortName'\u003e\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003etrue\u003c/Data\u003e\u003cData Name='DestinationIp'\u003e2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e5355\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003ellmnr\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "3", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 15, "computer_name": "vagrant-2012-r2", "opcode": "Info", "time_created": "2019-03-18T16:57:49.340Z", "process": { "pid": 4860, "thread": { "id": 4492 } }, "event_data": { "Protocol": "udp", "UtcTime": "2019-03-18 16:57:48.250", "User": "NT AUTHORITY\\NETWORK SERVICE", "Image": "C:\\Windows\\System32\\svchost.exe", "SourceIp": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", "DestinationPort": "5355", "DestinationPortName": "llmnr", "ProcessGuid": "{42f11c3b-0bad-5c8c-0000-0010dfbc0000}", "ProcessId": "924", "DestinationIp": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", "SourceIsIpv6": "true", "SourcePort": "55542", "Initiated": "true", "DestinationIsIpv6": "true" }, "event_id": "3", "provider_name": "Microsoft-Windows-Sysmon", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" } } }, { "@timestamp": "2021-05-05T15:30:51.701Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:49.340580700Z'/\u003e\u003cEventRecordID\u003e16\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:48.250\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-6e19-5c8c-0000-0010eb030000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4\u003c/Data\u003e\u003cData Name='Image'\u003eSystem\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\SYSTEM\u003c/Data\u003e\u003cData Name='Protocol'\u003eudp\u003c/Data\u003e\u003cData Name='Initiated'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='SourceIp'\u003e89.160.20.156\u003c/Data\u003e\u003cData Name='SourceHostname'\u003e\u003c/Data\u003e\u003cData Name='SourcePort'\u003e137\u003c/Data\u003e\u003cData Name='SourcePortName'\u003enetbios-ns\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='DestinationIp'\u003e89.160.20.156\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e137\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003enetbios-ns\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "3", "kind": "event" }, "winlog": { "user": { "identifier": "S-1-5-18" }, "process": { "pid": 4860, "thread": { "id": 4492 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2012-r2", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-03-18T16:57:49.340Z", "event_data": { "Image": "System", "User": "NT AUTHORITY\\SYSTEM", "Protocol": "udp", "DestinationPortName": "netbios-ns", "UtcTime": "2019-03-18 16:57:48.250", "SourceIsIpv6": "false", "DestinationIsIpv6": "false", "ProcessId": "4", "DestinationIp": "89.160.20.156", "ProcessGuid": "{42f11c3b-6e19-5c8c-0000-0010eb030000}", "Initiated": "true", "SourceIp": "89.160.20.156", "SourcePort": "137", "SourcePortName": "netbios-ns", "DestinationPort": "137" }, "event_id": "3", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 16, "opcode": "Info", "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.702Z", "log": { "level": "information" }, "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:49.340580700Z'/\u003e\u003cEventRecordID\u003e17\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:48.251\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-6e19-5c8c-0000-0010eb030000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4\u003c/Data\u003e\u003cData Name='Image'\u003eSystem\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\SYSTEM\u003c/Data\u003e\u003cData Name='Protocol'\u003eudp\u003c/Data\u003e\u003cData Name='Initiated'\u003efalse\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='SourceIp'\u003e89.160.20.156\u003c/Data\u003e\u003cData Name='SourceHostname'\u003e\u003c/Data\u003e\u003cData Name='SourcePort'\u003e137\u003c/Data\u003e\u003cData Name='SourcePortName'\u003enetbios-ns\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='DestinationIp'\u003e89.160.20.156\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e137\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003enetbios-ns\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "3" }, "winlog": { "record_id": 17, "opcode": "Info", "version": 5, "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-03-18T16:57:49.340Z", "level": "information", "event_data": { "UtcTime": "2019-03-18 16:57:48.251", "ProcessGuid": "{42f11c3b-6e19-5c8c-0000-0010eb030000}", "SourceIsIpv6": "false", "ProcessId": "4", "Initiated": "false", "User": "NT AUTHORITY\\SYSTEM", "SourceIp": "89.160.20.156", "DestinationIp": "89.160.20.156", "DestinationPort": "137", "Image": "System", "Protocol": "udp", "SourcePort": "137", "SourcePortName": "netbios-ns", "DestinationIsIpv6": "false", "DestinationPortName": "netbios-ns" }, "process": { "pid": 4860, "thread": { "id": 4492 } }, "event_id": "3", "computer_name": "vagrant-2012-r2" } }, { "@timestamp": "2021-05-05T15:30:51.703Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:49.340580700Z'/\u003e\u003cEventRecordID\u003e18\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:48.251\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-0bad-5c8c-0000-0010dfbc0000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e924\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\NETWORK SERVICE\u003c/Data\u003e\u003cData Name='Protocol'\u003eudp\u003c/Data\u003e\u003cData Name='Initiated'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIp'\u003efe80:0:0:0:616f:32fa:b04f:b419\u003c/Data\u003e\u003cData Name='SourceHostname'\u003e\u003c/Data\u003e\u003cData Name='SourcePort'\u003e55717\u003c/Data\u003e\u003cData Name='SourcePortName'\u003e\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003etrue\u003c/Data\u003e\u003cData Name='DestinationIp'\u003eff02:0:0:0:0:0:1:3\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e5355\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003ellmnr\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "3", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "user": { "identifier": "S-1-5-18" }, "event_data": { "Image": "C:\\Windows\\System32\\svchost.exe", "User": "NT AUTHORITY\\NETWORK SERVICE", "Protocol": "udp", "SourceIsIpv6": "true", "SourcePort": "55717", "DestinationPort": "5355", "UtcTime": "2019-03-18 16:57:48.251", "ProcessId": "924", "DestinationPortName": "llmnr", "ProcessGuid": "{42f11c3b-0bad-5c8c-0000-0010dfbc0000}", "DestinationIp": "ff02:0:0:0:0:0:1:3", "Initiated": "true", "SourceIp": "fe80:0:0:0:616f:32fa:b04f:b419", "DestinationIsIpv6": "true" }, "process": { "pid": 4860, "thread": { "id": 4492 } }, "computer_name": "vagrant-2012-r2", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "3", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 18, "time_created": "2019-03-18T16:57:49.340Z" } }, { "@timestamp": "2021-05-05T15:30:51.703Z", "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "version": 5, "time_created": "2019-03-18T16:57:49.340Z", "level": "information", "process": { "pid": 4860, "thread": { "id": 4492 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 19, "computer_name": "vagrant-2012-r2", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "event_data": { "User": "NT AUTHORITY\\NETWORK SERVICE", "Initiated": "true", "DestinationIsIpv6": "true", "DestinationIp": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", "DestinationPortName": "llmnr", "ProcessGuid": "{42f11c3b-0bad-5c8c-0000-0010dfbc0000}", "SourceIp": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", "UtcTime": "2019-03-18 16:57:48.251", "ProcessId": "924", "Image": "C:\\Windows\\System32\\svchost.exe", "Protocol": "udp", "SourceIsIpv6": "true", "SourcePort": "55717", "DestinationPort": "5355" }, "event_id": "3" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:49.340580700Z'/\u003e\u003cEventRecordID\u003e19\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:48.251\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-0bad-5c8c-0000-0010dfbc0000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e924\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\NETWORK SERVICE\u003c/Data\u003e\u003cData Name='Protocol'\u003eudp\u003c/Data\u003e\u003cData Name='Initiated'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIp'\u003e2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\u003c/Data\u003e\u003cData Name='SourceHostname'\u003e\u003c/Data\u003e\u003cData Name='SourcePort'\u003e55717\u003c/Data\u003e\u003cData Name='SourcePortName'\u003e\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003etrue\u003c/Data\u003e\u003cData Name='DestinationIp'\u003e2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e5355\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003ellmnr\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "3", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.703Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:49.340580700Z'/\u003e\u003cEventRecordID\u003e20\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:48.264\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-6e19-5c8c-0000-0010eb030000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4\u003c/Data\u003e\u003cData Name='Image'\u003eSystem\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\SYSTEM\u003c/Data\u003e\u003cData Name='Protocol'\u003eudp\u003c/Data\u003e\u003cData Name='Initiated'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='SourceIp'\u003e10.0.2.15\u003c/Data\u003e\u003cData Name='SourceHostname'\u003evagrant-2012-r2.local.crowbird.com\u003c/Data\u003e\u003cData Name='SourcePort'\u003e137\u003c/Data\u003e\u003cData Name='SourcePortName'\u003enetbios-ns\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='DestinationIp'\u003e89.160.20.156\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e137\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003enetbios-ns\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "3", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 20, "computer_name": "vagrant-2012-r2", "time_created": "2019-03-18T16:57:49.340Z", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 4860, "thread": { "id": 4492 } }, "event_id": "3", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "event_data": { "SourcePortName": "netbios-ns", "DestinationPortName": "netbios-ns", "User": "NT AUTHORITY\\SYSTEM", "Initiated": "true", "SourceIp": "10.0.2.15", "UtcTime": "2019-03-18 16:57:48.264", "DestinationIp": "89.160.20.156", "DestinationIsIpv6": "false", "ProcessId": "4", "Protocol": "udp", "SourceHostname": "vagrant-2012-r2.local.crowbird.com", "SourcePort": "137", "DestinationPort": "137", "ProcessGuid": "{42f11c3b-6e19-5c8c-0000-0010eb030000}", "Image": "System", "SourceIsIpv6": "false" } }, "host": { "name": "vagrant-2012-r2" } }, { "@timestamp": "2021-05-05T15:30:51.703Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:49.340580700Z'/\u003e\u003cEventRecordID\u003e21\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:48.276\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-6e19-5c8c-0000-0010eb030000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4\u003c/Data\u003e\u003cData Name='Image'\u003eSystem\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\SYSTEM\u003c/Data\u003e\u003cData Name='Protocol'\u003eudp\u003c/Data\u003e\u003cData Name='Initiated'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='SourceIp'\u003e10.0.2.15\u003c/Data\u003e\u003cData Name='SourceHostname'\u003evagrant-2012-r2.local.crowbird.com\u003c/Data\u003e\u003cData Name='SourcePort'\u003e137\u003c/Data\u003e\u003cData Name='SourcePortName'\u003enetbios-ns\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='DestinationIp'\u003e10.0.2.3\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e137\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003enetbios-ns\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "3", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_id": "3", "process": { "pid": 4860, "thread": { "id": 4492 } }, "time_created": "2019-03-18T16:57:49.340Z", "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 21, "computer_name": "vagrant-2012-r2", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-03-18 16:57:48.276", "User": "NT AUTHORITY\\SYSTEM", "DestinationIsIpv6": "false", "DestinationIp": "10.0.2.3", "ProcessId": "4", "Image": "System", "SourceIp": "10.0.2.15", "SourcePort": "137", "SourcePortName": "netbios-ns", "Protocol": "udp", "Initiated": "true", "SourceIsIpv6": "false", "SourceHostname": "vagrant-2012-r2.local.crowbird.com", "DestinationPort": "137", "ProcessGuid": "{42f11c3b-6e19-5c8c-0000-0010eb030000}", "DestinationPortName": "netbios-ns" } }, "host": { "name": "vagrant-2012-r2" } }, { "@timestamp": "2021-05-05T15:30:51.703Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:50.357238700Z'/\u003e\u003cEventRecordID\u003e22\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:49.213\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-6e19-5c8c-0000-0010eb030000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4\u003c/Data\u003e\u003cData Name='Image'\u003eSystem\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\SYSTEM\u003c/Data\u003e\u003cData Name='Protocol'\u003eudp\u003c/Data\u003e\u003cData Name='Initiated'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='SourceIp'\u003e10.0.2.15\u003c/Data\u003e\u003cData Name='SourceHostname'\u003evagrant-2012-r2.local.crowbird.com\u003c/Data\u003e\u003cData Name='SourcePort'\u003e137\u003c/Data\u003e\u003cData Name='SourcePortName'\u003enetbios-ns\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='DestinationIp'\u003e89.160.20.156\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e137\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003enetbios-ns\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "3", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "record_id": 22, "computer_name": "vagrant-2012-r2", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-03-18T16:57:50.357Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "DestinationIsIpv6": "false", "DestinationIp": "89.160.20.156", "ProcessGuid": "{42f11c3b-6e19-5c8c-0000-0010eb030000}", "User": "NT AUTHORITY\\SYSTEM", "Initiated": "true", "SourceIp": "10.0.2.15", "SourceHostname": "vagrant-2012-r2.local.crowbird.com", "ProcessId": "4", "Image": "System", "Protocol": "udp", "SourcePort": "137", "DestinationPortName": "netbios-ns", "UtcTime": "2019-03-18 16:57:49.213", "SourceIsIpv6": "false", "SourcePortName": "netbios-ns", "DestinationPort": "137" }, "process": { "pid": 4860, "thread": { "id": 4492 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "3", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.701Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.029861900Z'/\u003e\u003cEventRecordID\u003e128\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.890\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eapi-s2s.taboola.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 f2.taboola.map.fastly.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:04.029Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.890", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "api-s2s.taboola.com", "QueryStatus": "0", "QueryResults": "type: 5 f2.taboola.map.fastly.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "record_id": 128, "opcode": "Info" } }, { "@timestamp": "2021-05-05T15:30:51.701Z", "winlog": { "time_created": "2019-07-18T03:34:04.029Z", "event_data": { "UtcTime": "2019-07-18 03:34:03.892", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "x.bidswitch.net", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 129, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info" }, "log": { "level": "information" }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.029870000Z'/\u003e\u003cEventRecordID\u003e129\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.892\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ex.bidswitch.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" } }, { "@timestamp": "2021-05-05T15:30:51.701Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.029880600Z'/\u003e\u003cEventRecordID\u003e130\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.894\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003epixel.adsafeprotected.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 anycast.pixel.adsafeprotected.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event" }, "log": { "level": "information" }, "winlog": { "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "version": 5, "time_created": "2019-07-18T03:34:04.029Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryName": "pixel.adsafeprotected.com", "QueryStatus": "0", "QueryResults": "type: 5 anycast.pixel.adsafeprotected.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.894", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 130, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.702Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.029890100Z'/\u003e\u003cEventRecordID\u003e131\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.894\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eml314.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event" }, "winlog": { "computer_name": "vagrant-2016", "version": 5, "time_created": "2019-07-18T03:34:04.029Z", "level": "information", "event_data": { "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.894", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ml314.com" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "record_id": 131, "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" } }, { "@timestamp": "2021-05-05T15:30:51.704Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.029900000Z'/\u003e\u003cEventRecordID\u003e132\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.902\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eaa.agkn.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event" }, "winlog": { "record_id": 132, "version": 5, "time_created": "2019-07-18T03:34:04.029Z", "level": "information", "event_data": { "ProcessId": "2736", "QueryName": "aa.agkn.com", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.902", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" } } }, { "@timestamp": "2021-05-05T15:30:51.704Z", "winlog": { "event_data": { "ProcessId": "2736", "QueryName": "s0.2mdn.net", "QueryStatus": "0", "QueryResults": "type: 5 s0-2mdn-net.l.google.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.911", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:04.029Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 133, "opcode": "Info", "version": 5, "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } } }, "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.029909900Z'/\u003e\u003cEventRecordID\u003e133\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.911\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003es0.2mdn.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 s0-2mdn-net.l.google.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.704Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.029920400Z'/\u003e\u003cEventRecordID\u003e134\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.911\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eb.scorecardresearch.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 b.scorecardresearch.com.edgesuite.net;type: 5 a1294.w20.akamai.net;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "level": "information", "user": { "identifier": "S-1-5-18" }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 134, "computer_name": "vagrant-2016", "version": 5, "time_created": "2019-07-18T03:34:04.029Z", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "event_data": { "ProcessId": "2736", "QueryName": "b.scorecardresearch.com", "QueryStatus": "0", "QueryResults": "type: 5 b.scorecardresearch.com.edgesuite.net;type: 5 a1294.w20.akamai.net;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.911", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" } } }, { "@timestamp": "2021-05-05T15:30:51.704Z", "winlog": { "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "event_id": "22", "computer_name": "vagrant-2016", "record_id": 135, "opcode": "Info", "version": 5, "time_created": "2019-07-18T03:34:04.548Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessId": "2736", "QueryName": "edw.edmunds.com", "QueryStatus": "0", "QueryResults": "type: 5 f2.shared.global.fastly.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:03.921", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "process": { "pid": 2828, "thread": { "id": 1684 } } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.548958100Z'/\u003e\u003cEventRecordID\u003e135\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:03.921\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eedw.edmunds.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 f2.shared.global.fastly.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.704Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692712500Z'/\u003e\u003cEventRecordID\u003e136\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.101\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eocsp.digicert.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 cs9.wac.phicdn.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" }, "winlog": { "event_data": { "QueryStatus": "0", "QueryResults": "type: 5 cs9.wac.phicdn.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.101", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ocsp.digicert.com" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "time_created": "2019-07-18T03:34:04.692Z", "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 136, "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" } }, { "@timestamp": "2021-05-05T15:30:51.704Z", "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 137, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_id": "22", "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "time_created": "2019-07-18T03:34:04.692Z", "event_data": { "ProcessId": "2736", "QueryName": "pre-usermatch.targeting.unrulymedia.com", "QueryStatus": "0", "QueryResults": "type: 5 usermatch.targeting.unrulymedia.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.137", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "process": { "thread": { "id": 1684 }, "pid": 2828 } }, "log": { "level": "information" }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692750200Z'/\u003e\u003cEventRecordID\u003e137\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.137\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003epre-usermatch.targeting.unrulymedia.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 usermatch.targeting.unrulymedia.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" } }, { "@timestamp": "2021-05-05T15:30:51.704Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692762900Z'/\u003e\u003cEventRecordID\u003e138\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.141\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003efarm.plista.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 farm-hetzner.plista.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "record_id": 138, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:04.692Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "version": 5, "event_data": { "QueryName": "farm.plista.com", "QueryStatus": "0", "QueryResults": "type: 5 farm-hetzner.plista.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.141", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "computer_name": "vagrant-2016" } }, { "@timestamp": "2021-05-05T15:30:51.704Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692780500Z'/\u003e\u003cEventRecordID\u003e139\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.168\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ebeacon.krxd.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 beacon-n-ash.lb.krxd.net;type: 5 beacon-17-537698933.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" }, "winlog": { "event_id": "22", "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 139, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:04.692Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryStatus": "0", "QueryResults": "type: 5 beacon-n-ash.lb.krxd.net;type: 5 beacon-17-537698933.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.168", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "beacon.krxd.net" } } }, { "@timestamp": "2021-05-05T15:30:51.703Z", "winlog": { "user": { "identifier": "S-1-5-18" }, "event_data": { "SourceIsIpv6": "false", "DestinationPort": "137", "UtcTime": "2019-03-18 16:57:49.218", "ProcessGuid": "{42f11c3b-6e19-5c8c-0000-0010eb030000}", "Initiated": "true", "SourcePort": "137", "DestinationPortName": "netbios-ns", "ProcessId": "4", "Protocol": "udp", "SourceHostname": "vagrant-2012-r2.local.crowbird.com", "DestinationIp": "89.160.20.156", "DestinationIsIpv6": "false", "Image": "System", "User": "NT AUTHORITY\\SYSTEM", "SourceIp": "10.0.2.15", "SourcePortName": "netbios-ns" }, "event_id": "3", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 23, "computer_name": "vagrant-2012-r2", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "opcode": "Info", "version": 5, "time_created": "2019-03-18T16:57:50.357Z", "process": { "thread": { "id": 4492 }, "pid": 4860 } }, "log": { "level": "information" }, "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e3\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e3\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:50.357238700Z'/\u003e\u003cEventRecordID\u003e23\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4492'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:49.218\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-6e19-5c8c-0000-0010eb030000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4\u003c/Data\u003e\u003cData Name='Image'\u003eSystem\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\SYSTEM\u003c/Data\u003e\u003cData Name='Protocol'\u003eudp\u003c/Data\u003e\u003cData Name='Initiated'\u003etrue\u003c/Data\u003e\u003cData Name='SourceIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='SourceIp'\u003e10.0.2.15\u003c/Data\u003e\u003cData Name='SourceHostname'\u003evagrant-2012-r2.local.crowbird.com\u003c/Data\u003e\u003cData Name='SourcePort'\u003e137\u003c/Data\u003e\u003cData Name='SourcePortName'\u003enetbios-ns\u003c/Data\u003e\u003cData Name='DestinationIsIpv6'\u003efalse\u003c/Data\u003e\u003cData Name='DestinationIp'\u003e89.160.20.156\u003c/Data\u003e\u003cData Name='DestinationHostname'\u003e\u003c/Data\u003e\u003cData Name='DestinationPort'\u003e137\u003c/Data\u003e\u003cData Name='DestinationPortName'\u003enetbios-ns\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "3" } }, { "@timestamp": "2021-05-05T15:30:51.703Z", "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "5", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "process": { "pid": 4860, "thread": { "id": 4516 } }, "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-03-18 16:57:52.350", "ProcessGuid": "{42f11c3b-ccc6-5c8f-0000-001005082900}", "ProcessId": "4832", "Image": "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe" }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 24, "computer_name": "vagrant-2012-r2", "opcode": "Info", "version": 3, "time_created": "2019-03-18T16:57:52.354Z" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e5\u003c/EventID\u003e\u003cVersion\u003e3\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e5\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:52.354274600Z'/\u003e\u003cEventRecordID\u003e24\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:52.350\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-ccc6-5c8f-0000-001005082900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4832\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "5", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.703Z", "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e5\u003c/EventID\u003e\u003cVersion\u003e3\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e5\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:52.364042800Z'/\u003e\u003cEventRecordID\u003e25\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:52.364\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-cccc-5c8f-0000-0010e8272900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e3208\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "5", "kind": "event" }, "winlog": { "event_id": "5", "provider_name": "Microsoft-Windows-Sysmon", "level": "information", "event_data": { "UtcTime": "2019-03-18 16:57:52.364", "ProcessGuid": "{42f11c3b-cccc-5c8f-0000-0010e8272900}", "ProcessId": "3208", "Image": "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe" }, "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2012-r2", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 3, "time_created": "2019-03-18T16:57:52.364Z", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 4860, "thread": { "id": 4516 } }, "record_id": 25 } }, { "@timestamp": "2021-05-05T15:30:51.704Z", "winlog": { "event_data": { "ProcessGuid": "{42f11c3b-ccaa-5c8f-0000-0010b4e22700}", "ProcessId": "1600", "Image": "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe", "TargetFilename": "C:\\Users\\vagrant\\AppData\\Local\\Google\\Chrome\\User Data\\fe823684-c940-49f2-a940-14b02cbafba9.tmp", "CreationUtcTime": "2019-03-18 16:52:04.980", "PreviousCreationUtcTime": "2019-03-18 16:57:52.387", "UtcTime": "2019-03-18 16:57:52.387" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2012-r2", "version": 4, "time_created": "2019-03-18T16:57:52.402Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "process": { "thread": { "id": 4516 }, "pid": 4860 }, "event_id": "2", "record_id": 26, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e2\u003c/EventID\u003e\u003cVersion\u003e4\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e2\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:52.402119100Z'/\u003e\u003cEventRecordID\u003e26\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:52.387\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-ccaa-5c8f-0000-0010b4e22700}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e1600\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\u003c/Data\u003e\u003cData Name='TargetFilename'\u003eC:\\Users\\vagrant\\AppData\\Local\\Google\\Chrome\\User Data\\fe823684-c940-49f2-a940-14b02cbafba9.tmp\u003c/Data\u003e\u003cData Name='CreationUtcTime'\u003e2019-03-18 16:52:04.980\u003c/Data\u003e\u003cData Name='PreviousCreationUtcTime'\u003e2019-03-18 16:57:52.387\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "2", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.705Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e2\u003c/EventID\u003e\u003cVersion\u003e4\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e2\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:52.417733000Z'/\u003e\u003cEventRecordID\u003e27\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:52.417\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-ccaa-5c8f-0000-0010b4e22700}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e1600\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\u003c/Data\u003e\u003cData Name='TargetFilename'\u003eC:\\Users\\vagrant\\AppData\\Local\\Google\\Chrome\\User Data\\162d4140-cfab-4d05-9c92-bca60515a622.tmp\u003c/Data\u003e\u003cData Name='CreationUtcTime'\u003e2019-03-18 16:52:04.980\u003c/Data\u003e\u003cData Name='PreviousCreationUtcTime'\u003e2019-03-18 16:57:52.402\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "2", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "version": 4, "level": "information", "user": { "identifier": "S-1-5-18" }, "record_id": 27, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "computer_name": "vagrant-2012-r2", "time_created": "2019-03-18T16:57:52.417Z", "event_data": { "ProcessId": "1600", "Image": "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe", "TargetFilename": "C:\\Users\\vagrant\\AppData\\Local\\Google\\Chrome\\User Data\\162d4140-cfab-4d05-9c92-bca60515a622.tmp", "CreationUtcTime": "2019-03-18 16:52:04.980", "PreviousCreationUtcTime": "2019-03-18 16:57:52.402", "UtcTime": "2019-03-18 16:57:52.417", "ProcessGuid": "{42f11c3b-ccaa-5c8f-0000-0010b4e22700}" }, "process": { "pid": 4860, "thread": { "id": 4516 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "2", "provider_name": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.705Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e2\u003c/EventID\u003e\u003cVersion\u003e4\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e2\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:52.417733000Z'/\u003e\u003cEventRecordID\u003e28\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:52.417\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-ccaa-5c8f-0000-0010b4e22700}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e1600\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\u003c/Data\u003e\u003cData Name='TargetFilename'\u003eC:\\Users\\vagrant\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\1450fedf-ac4c-4e35-b371-ed5d3bbe4776.tmp\u003c/Data\u003e\u003cData Name='CreationUtcTime'\u003e2019-03-18 16:52:05.028\u003c/Data\u003e\u003cData Name='PreviousCreationUtcTime'\u003e2019-03-18 16:57:52.402\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "2", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 4, "time_created": "2019-03-18T16:57:52.417Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 4860, "thread": { "id": 4516 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "2", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 28, "computer_name": "vagrant-2012-r2", "event_data": { "UtcTime": "2019-03-18 16:57:52.417", "ProcessGuid": "{42f11c3b-ccaa-5c8f-0000-0010b4e22700}", "ProcessId": "1600", "Image": "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe", "TargetFilename": "C:\\Users\\vagrant\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\1450fedf-ac4c-4e35-b371-ed5d3bbe4776.tmp", "CreationUtcTime": "2019-03-18 16:52:05.028", "PreviousCreationUtcTime": "2019-03-18 16:57:52.402" } } }, { "@timestamp": "2021-05-05T15:30:51.705Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e2\u003c/EventID\u003e\u003cVersion\u003e4\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e2\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:52.417733000Z'/\u003e\u003cEventRecordID\u003e29\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:52.417\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-ccaa-5c8f-0000-0010b4e22700}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e1600\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\u003c/Data\u003e\u003cData Name='TargetFilename'\u003eC:\\Users\\vagrant\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\37ed32e9-3c5f-4663-8457-c70743e9456d.tmp\u003c/Data\u003e\u003cData Name='CreationUtcTime'\u003e2019-03-18 16:51:54.980\u003c/Data\u003e\u003cData Name='PreviousCreationUtcTime'\u003e2019-03-18 16:57:52.417\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "2", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_id": "2", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2012-r2", "version": 4, "time_created": "2019-03-18T16:57:52.417Z", "level": "information", "process": { "pid": 4860, "thread": { "id": 4516 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 29, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "event_data": { "CreationUtcTime": "2019-03-18 16:51:54.980", "PreviousCreationUtcTime": "2019-03-18 16:57:52.417", "UtcTime": "2019-03-18 16:57:52.417", "ProcessGuid": "{42f11c3b-ccaa-5c8f-0000-0010b4e22700}", "ProcessId": "1600", "Image": "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe", "TargetFilename": "C:\\Users\\vagrant\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\37ed32e9-3c5f-4663-8457-c70743e9456d.tmp" } } }, { "@timestamp": "2021-05-05T15:30:51.705Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e5\u003c/EventID\u003e\u003cVersion\u003e3\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e5\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:52.433367300Z'/\u003e\u003cEventRecordID\u003e30\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:52.433\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-ccab-5c8f-0000-001064eb2700}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2680\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "5", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "version": 3, "level": "information", "event_data": { "UtcTime": "2019-03-18 16:57:52.433", "ProcessGuid": "{42f11c3b-ccab-5c8f-0000-001064eb2700}", "ProcessId": "2680", "Image": "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "5", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 4860, "thread": { "id": 4516 } }, "record_id": 30, "computer_name": "vagrant-2012-r2", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-03-18T16:57:52.433Z" }, "agent": { "name": "mbp.local", "type": "filebeat", "version": "8.0.0", "ephemeral_id": "bdc6a4f9-ab87-41e0-a64e-bbcecdf73c6c", "id": "f0224db8-40a9-4f00-b117-333ddd1bc45b" } }, { "@timestamp": "2021-05-05T15:30:51.705Z", "log": { "level": "information" }, "event": { "code": "2", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e2\u003c/EventID\u003e\u003cVersion\u003e4\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e2\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:52.433367300Z'/\u003e\u003cEventRecordID\u003e31\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:52.433\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-ccaa-5c8f-0000-0010b4e22700}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e1600\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\u003c/Data\u003e\u003cData Name='TargetFilename'\u003eC:\\Users\\vagrant\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Storage\\ext\\nmmhkkegccagdldgiimedpiccmgmieda\\def\\ecb9c915-c4c2-4600-a920-f2bc302990a8.tmp\u003c/Data\u003e\u003cData Name='CreationUtcTime'\u003e2019-03-18 16:52:08.496\u003c/Data\u003e\u003cData Name='PreviousCreationUtcTime'\u003e2019-03-18 16:57:52.417\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "winlog": { "opcode": "Info", "process": { "pid": 4860, "thread": { "id": 4516 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2012-r2", "record_id": 31, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 4, "time_created": "2019-03-18T16:57:52.433Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_id": "2", "provider_name": "Microsoft-Windows-Sysmon", "event_data": { "Image": "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe", "TargetFilename": "C:\\Users\\vagrant\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Storage\\ext\\nmmhkkegccagdldgiimedpiccmgmieda\\def\\ecb9c915-c4c2-4600-a920-f2bc302990a8.tmp", "CreationUtcTime": "2019-03-18 16:52:08.496", "PreviousCreationUtcTime": "2019-03-18 16:57:52.417", "UtcTime": "2019-03-18 16:57:52.433", "ProcessGuid": "{42f11c3b-ccaa-5c8f-0000-0010b4e22700}", "ProcessId": "1600" } } }, { "@timestamp": "2021-05-05T15:30:51.704Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692791400Z'/\u003e\u003cEventRecordID\u003e140\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.169\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003edsum.casalemedia.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 dsum.casalemedia.com.edgekey.net;type: 5 e8037.g.akamaiedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "log": { "level": "information" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "time_created": "2019-07-18T03:34:04.692Z", "level": "information", "event_data": { "QueryResults": "type: 5 dsum.casalemedia.com.edgekey.net;type: 5 e8037.g.akamaiedge.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.169", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "dsum.casalemedia.com", "QueryStatus": "0" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 140, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" } } }, { "@timestamp": "2021-05-05T15:30:51.704Z", "winlog": { "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.169", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "sync.mathtag.com", "QueryStatus": "0", "QueryResults": "type: 5 pixel-origin.mathtag.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;" }, "record_id": 141, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "version": 5, "time_created": "2019-07-18T03:34:04.692Z", "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692803100Z'/\u003e\u003cEventRecordID\u003e141\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.169\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003esync.mathtag.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 pixel-origin.mathtag.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.705Z", "winlog": { "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:04.692Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessId": "2736", "QueryName": "status.rapidssl.com", "QueryStatus": "0", "QueryResults": "type: 5 ocsp.digicert.com;type: 5 cs9.wac.phicdn.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.184", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 142, "computer_name": "vagrant-2016", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational" }, "log": { "level": "information" }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692814000Z'/\u003e\u003cEventRecordID\u003e142\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.184\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003estatus.rapidssl.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 ocsp.digicert.com;type: 5 cs9.wac.phicdn.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" } }, { "@timestamp": "2021-05-05T15:30:51.705Z", "winlog": { "process": { "pid": 2828, "thread": { "id": 1684 } }, "record_id": 143, "version": 5, "time_created": "2019-07-18T03:34:04.692Z", "level": "information", "event_data": { "QueryResults": "type: 5 cookiesyncing-1395500543.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.184", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "sync.extend.tv", "QueryStatus": "0" }, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "opcode": "Info" }, "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692826300Z'/\u003e\u003cEventRecordID\u003e143\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.184\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003esync.extend.tv\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 cookiesyncing-1395500543.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.706Z", "winlog": { "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:04.692Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:04.185", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ocsp.comodoca.com", "QueryStatus": "0", "QueryResults": "type: 5 t3j2g9x7.stackpathcdn.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "record_id": 144, "computer_name": "vagrant-2016" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692837600Z'/\u003e\u003cEventRecordID\u003e144\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.185\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eocsp.comodoca.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 t3j2g9x7.stackpathcdn.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.706Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692848900Z'/\u003e\u003cEventRecordID\u003e145\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.189\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003esync-tm.everesttech.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 sync.tubemogul.com;type: 5 syncf.tubemogul.com;type: 5 h2.shared.global.fastly.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "record_id": 145, "computer_name": "vagrant-2016", "version": 5, "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:04.692Z", "level": "information", "event_data": { "UtcTime": "2019-07-18 03:34:04.189", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "sync-tm.everesttech.net", "QueryStatus": "0", "QueryResults": "type: 5 sync.tubemogul.com;type: 5 syncf.tubemogul.com;type: 5 h2.shared.global.fastly.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "event_id": "22" } }, { "@timestamp": "2021-05-05T15:30:51.706Z", "winlog": { "time_created": "2019-07-18T03:34:04.692Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 146, "opcode": "Info", "version": 5, "process": { "pid": 2828, "thread": { "id": 1684 } }, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryName": "idsync.rlcdn.com", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;192.168.51.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.237", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692865100Z'/\u003e\u003cEventRecordID\u003e146\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.237\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eidsync.rlcdn.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;192.168.51.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.706Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692882700Z'/\u003e\u003cEventRecordID\u003e147\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.274\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ecm.adform.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 track-eu.adformnet.akadns.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" }, "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "record_id": 147, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:04.692Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.274", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "cm.adform.net", "QueryStatus": "0", "QueryResults": "type: 5 track-eu.adformnet.akadns.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "computer_name": "vagrant-2016", "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.706Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692891900Z'/\u003e\u003cEventRecordID\u003e148\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.302\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003edm.hybrid.ai\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" }, "winlog": { "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:04.692Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:04.302", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "dm.hybrid.ai", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 148, "opcode": "Info", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2016", "version": 5, "level": "information" }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.706Z", "winlog": { "event_data": { "UtcTime": "2019-07-18 03:34:04.304", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "static.adsafeprotected.com", "QueryStatus": "0", "QueryResults": "type: 5 anycast.static.adsafeprotected.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 149, "version": 5, "time_created": "2019-07-18T03:34:04.692Z", "user": { "identifier": "S-1-5-18" }, "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692904200Z'/\u003e\u003cEventRecordID\u003e149\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.304\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003estatic.adsafeprotected.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 anycast.static.adsafeprotected.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" } }, { "@timestamp": "2021-05-05T15:30:51.706Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692920100Z'/\u003e\u003cEventRecordID\u003e150\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.322\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003etrc.taboola.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 f2.taboola.map.fastly.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" }, "winlog": { "event_data": { "UtcTime": "2019-07-18 03:34:04.322", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "trc.taboola.com", "QueryStatus": "0", "QueryResults": "type: 5 f2.taboola.map.fastly.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "record_id": 150, "version": 5, "time_created": "2019-07-18T03:34:04.692Z", "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.706Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692935200Z'/\u003e\u003cEventRecordID\u003e151\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.379\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003epippio.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 151, "computer_name": "vagrant-2016", "version": 5, "event_data": { "UtcTime": "2019-07-18 03:34:04.379", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "pippio.com", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:04.692Z", "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.706Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.692997300Z'/\u003e\u003cEventRecordID\u003e152\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.482\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003epixel-sync.sitescout.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 pixel-a.sitescout.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.482", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "pixel-sync.sitescout.com", "QueryStatus": "0", "QueryResults": "type: 5 pixel-a.sitescout.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;" }, "user": { "identifier": "S-1-5-18" }, "process": { "thread": { "id": 1684 }, "pid": 2828 }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 152, "opcode": "Info", "time_created": "2019-07-18T03:34:04.692Z" } }, { "@timestamp": "2021-05-05T15:30:51.706Z", "winlog": { "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:04.502", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "prod.y-medialink.com", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "event_id": "22", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "computer_name": "vagrant-2016", "time_created": "2019-07-18T03:34:04.693Z", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 153 }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.693010700Z'/\u003e\u003cEventRecordID\u003e153\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.502\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eprod.y-medialink.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" } }, { "@timestamp": "2021-05-05T15:30:51.707Z", "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "time_created": "2019-07-18T03:34:04.693Z", "level": "information", "event_data": { "QueryResults": "type: 5 jadserve.postrelease.com.akadns.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.507", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "jadserve.postrelease.com", "QueryStatus": "0" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 154, "computer_name": "vagrant-2016", "version": 5, "process": { "pid": 2828, "thread": { "id": 1684 } } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.693021600Z'/\u003e\u003cEventRecordID\u003e154\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.507\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ejadserve.postrelease.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 jadserve.postrelease.com.akadns.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.707Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.693033600Z'/\u003e\u003cEventRecordID\u003e155\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.508\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eappnexus-partners.tremorhub.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 partners-1732315393.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_data": { "UtcTime": "2019-07-18 03:34:04.508", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "appnexus-partners.tremorhub.com", "QueryStatus": "0", "QueryResults": "type: 5 partners-1732315393.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 155, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:04.693Z", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "opcode": "Info", "level": "information", "user": { "identifier": "S-1-5-18" } } }, { "@timestamp": "2021-05-05T15:30:51.707Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.693044900Z'/\u003e\u003cEventRecordID\u003e156\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.531\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ex.dlx.addthis.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 gtm13.nexac.com;type: 5 ad2deadfb5fbf11e9872302ad9419486-194325762.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" }, "winlog": { "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 156, "version": 5, "level": "information", "event_data": { "QueryName": "x.dlx.addthis.com", "QueryStatus": "0", "QueryResults": "type: 5 gtm13.nexac.com;type: 5 ad2deadfb5fbf11e9872302ad9419486-194325762.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.531", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "time_created": "2019-07-18T03:34:04.693Z", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" } }, { "@timestamp": "2021-05-05T15:30:51.707Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.693057200Z'/\u003e\u003cEventRecordID\u003e157\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.532\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003edh.serving-sys.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 haproxy-dmp.sizmdx.com;type: 5 dmp-prod-haproxyd-14y2amas34vrd-330219680.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "record_id": 157, "computer_name": "vagrant-2016", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessId": "2736", "QueryName": "dh.serving-sys.com", "QueryStatus": "0", "QueryResults": "type: 5 haproxy-dmp.sizmdx.com;type: 5 dmp-prod-haproxyd-14y2amas34vrd-330219680.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.532", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:04.693Z", "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.707Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.693070300Z'/\u003e\u003cEventRecordID\u003e158\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.534\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ematch.sharethrough.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 match-us-east-1.sharethrough.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "opcode": "Info", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryResults": "type: 5 match-us-east-1.sharethrough.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.534", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "match.sharethrough.com", "QueryStatus": "0" }, "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "record_id": 158, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:04.693Z", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22" }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.707Z", "winlog": { "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:04.836Z", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 159, "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "event_id": "22", "event_data": { "QueryName": "tags.rd.linksynergy.com", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.601", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.836591400Z'/\u003e\u003cEventRecordID\u003e159\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.601\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003etags.rd.linksynergy.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.707Z", "log": { "level": "information" }, "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.836608300Z'/\u003e\u003cEventRecordID\u003e160\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.604\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ertb-csync.smartadserver.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 2-01-275d-002d.cdx.cedexis.net;type: 5 rtb-csync-tmk.smartadserver.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22" }, "winlog": { "event_data": { "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "rtb-csync.smartadserver.com", "QueryStatus": "0", "QueryResults": "type: 5 2-01-275d-002d.cdx.cedexis.net;type: 5 rtb-csync-tmk.smartadserver.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.604" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:04.836Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_id": "22", "record_id": 160, "computer_name": "vagrant-2016", "opcode": "Info", "version": 5 } }, { "@timestamp": "2021-05-05T15:30:51.707Z", "winlog": { "event_data": { "QueryResults": "type: 5 anycast.sc.iasds01.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.621", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "sc.iasds01.com", "QueryStatus": "0" }, "process": { "thread": { "id": 1684 }, "pid": 2828 }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:04.836Z", "record_id": 161, "computer_name": "vagrant-2016", "opcode": "Info", "level": "information", "user": { "identifier": "S-1-5-18" } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:04.836626600Z'/\u003e\u003cEventRecordID\u003e161\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.621\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003esc.iasds01.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 anycast.sc.iasds01.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" } }, { "@timestamp": "2021-05-05T15:30:51.707Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:05.034646400Z'/\u003e\u003cEventRecordID\u003e162\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.822\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003edt.adsafeprotected.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 sjedt.adsafeprotected.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 162, "opcode": "Info", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryStatus": "0", "QueryResults": "type: 5 sjedt.adsafeprotected.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.822", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "dt.adsafeprotected.com" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:05.034Z", "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.707Z", "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "record_id": 163, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:05.034Z", "channel": "Microsoft-Windows-Sysmon/Operational", "opcode": "Info", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:04.822", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "status.thawte.com", "QueryStatus": "0", "QueryResults": "type: 5 ocsp.digicert.com;type: 5 cs9.wac.phicdn.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:05.034657300Z'/\u003e\u003cEventRecordID\u003e163\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.822\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003estatus.thawte.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 ocsp.digicert.com;type: 5 cs9.wac.phicdn.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" } }, { "@timestamp": "2021-05-05T15:30:51.707Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:05.034798300Z'/\u003e\u003cEventRecordID\u003e164\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.860\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eads.stickyadstv.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 ip1.ads.stickyadstv.com.akadns.net;type: 5 wlb1.ads.stickyadstv.com.akadns.net;type: 5 fp4.ads.stickyadstv.com.akadns.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_data": { "QueryStatus": "0", "QueryResults": "type: 5 ip1.ads.stickyadstv.com.akadns.net;type: 5 wlb1.ads.stickyadstv.com.akadns.net;type: 5 fp4.ads.stickyadstv.com.akadns.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.860", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ads.stickyadstv.com" }, "record_id": 164, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "time_created": "2019-07-18T03:34:05.034Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "process": { "pid": 2828, "thread": { "id": 1684 } } }, "agent": { "name": "mbp.local", "type": "filebeat", "version": "8.0.0", "ephemeral_id": "bdc6a4f9-ab87-41e0-a64e-bbcecdf73c6c", "id": "f0224db8-40a9-4f00-b117-333ddd1bc45b" } }, { "@timestamp": "2021-05-05T15:30:51.708Z", "log": { "level": "information" }, "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:06.051692700Z'/\u003e\u003cEventRecordID\u003e165\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.904\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ehbx.media.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 hbx.media.net.edgekey.net;type: 5 e607.d.akamaiedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22" }, "winlog": { "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "computer_name": "vagrant-2016", "version": 5, "time_created": "2019-07-18T03:34:06.051Z", "event_data": { "QueryResults": "type: 5 hbx.media.net.edgekey.net;type: 5 e607.d.akamaiedge.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:04.904", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "hbx.media.net", "QueryStatus": "0" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 165, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.708Z", "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:06.051710000Z'/\u003e\u003cEventRecordID\u003e166\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:04.911\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ematch.taboola.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 trc.taboola.map.fastly.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "record_id": 166, "opcode": "Info", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:04.911", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "match.taboola.com", "QueryStatus": "0", "QueryResults": "type: 5 trc.taboola.map.fastly.net;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:06.051Z", "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.708Z", "winlog": { "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:06.051Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "img-s-msn-com.akamaized.net", "QueryStatus": "0", "QueryResults": "type: 5 a1834.dspg2.akamai.net;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:06.056" }, "record_id": 167 }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:06.051902900Z'/\u003e\u003cEventRecordID\u003e167\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:06.056\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eimg-s-msn-com.akamaized.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 a1834.dspg2.akamai.net;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.708Z", "winlog": { "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 168, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "event_data": { "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "static-entertainment-eus-s-msn-com.akamaized.net", "QueryStatus": "0", "QueryResults": "type: 5 a1505.g2.akamai.net;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:06.064" }, "opcode": "Info", "time_created": "2019-07-18T03:34:07.049Z", "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } } }, "log": { "level": "information" }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:07.049319700Z'/\u003e\u003cEventRecordID\u003e168\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:06.064\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003estatic-entertainment-eus-s-msn-com.akamaized.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 a1505.g2.akamai.net;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" } }, { "@timestamp": "2021-05-05T15:30:51.708Z", "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:07.049334900Z'/\u003e\u003cEventRecordID\u003e169\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:06.178\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eradarmaps.weather.microsoft.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 radarmaps.weather.microsoft.com.edgekey.net;type: 5 e15275.g.akamaiedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "winlog": { "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 169, "opcode": "Info", "version": 5, "time_created": "2019-07-18T03:34:07.049Z", "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:06.178", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "radarmaps.weather.microsoft.com", "QueryStatus": "0", "QueryResults": "type: 5 radarmaps.weather.microsoft.com.edgekey.net;type: 5 e15275.g.akamaiedge.net;::ffff:89.160.20.156;" }, "process": { "thread": { "id": 1684 }, "pid": 2828 } }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.708Z", "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:07.049349000Z'/\u003e\u003cEventRecordID\u003e170\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:06.455\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a8-5d2f-0000-001094619900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e356\u003c/Data\u003e\u003cData Name='QueryName'\u003estatic-entertainment-eus-s-msn-com.akamaized.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 a1505.g2.akamai.net;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" }, "winlog": { "time_created": "2019-07-18T03:34:07.049Z", "user": { "identifier": "S-1-5-18" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 170, "level": "information", "event_data": { "ProcessGuid": "{fa4a0de6-e8a8-5d2f-0000-001094619900}", "ProcessId": "356", "QueryName": "static-entertainment-eus-s-msn-com.akamaized.net", "QueryStatus": "0", "QueryResults": "type: 5 a1505.g2.akamai.net;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:06.455" }, "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.708Z", "winlog": { "event_id": "22", "record_id": 171, "opcode": "Info", "time_created": "2019-07-18T03:34:07.049Z", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_data": { "ProcessId": "2736", "QueryName": "tag.sp.advertising.com", "QueryStatus": "0", "QueryResults": "type: 5 cs747173190.wac.omegacdn.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:06.494", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:07.049364200Z'/\u003e\u003cEventRecordID\u003e171\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:06.494\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003etag.sp.advertising.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 cs747173190.wac.omegacdn.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.708Z", "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2016", "version": 5, "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:06.567", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "www.bing.com", "QueryStatus": "0", "QueryResults": "type: 5 a-0001.a-afdentry.net.trafficmanager.net;type: 5 dual-a-0001.a-msedge.net;::ffff:89.160.20.156;::ffff:89.160.20.156;" }, "user": { "identifier": "S-1-5-18" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 172, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:07.049Z", "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } } }, "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:07.049377200Z'/\u003e\u003cEventRecordID\u003e172\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:06.567\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ewww.bing.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 a-0001.a-afdentry.net.trafficmanager.net;type: 5 dual-a-0001.a-msedge.net;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.708Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:08.054270200Z'/\u003e\u003cEventRecordID\u003e173\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:07.228\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ecdn.doubleverify.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 akacdn.doubleverify.com.edgekey.net;type: 5 e17513.d.akamaiedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 173, "computer_name": "vagrant-2016", "opcode": "Info", "time_created": "2019-07-18T03:34:08.054Z", "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "user": { "identifier": "S-1-5-18" }, "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:07.228", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "cdn.doubleverify.com", "QueryStatus": "0", "QueryResults": "type: 5 akacdn.doubleverify.com.edgekey.net;type: 5 e17513.d.akamaiedge.net;::ffff:89.160.20.156;" } } }, { "@timestamp": "2021-05-05T15:30:51.708Z", "log": { "level": "information" }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:08.054302600Z'/\u003e\u003cEventRecordID\u003e174\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:07.357\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ecdn3.doubleverify.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 cdn.doubleverify.com;type: 5 akacdn.doubleverify.com.edgekey.net;type: 5 e17513.d.akamaiedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "winlog": { "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "record_id": 174, "computer_name": "vagrant-2016", "opcode": "Info", "time_created": "2019-07-18T03:34:08.054Z", "event_data": { "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "cdn3.doubleverify.com", "QueryStatus": "0", "QueryResults": "type: 5 cdn.doubleverify.com;type: 5 akacdn.doubleverify.com.edgekey.net;type: 5 e17513.d.akamaiedge.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:07.357" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon" }, "agent": { "id": "f0224db8-40a9-4f00-b117-333ddd1bc45b", "name": "mbp.local", "type": "filebeat", "version": "8.0.0", "ephemeral_id": "bdc6a4f9-ab87-41e0-a64e-bbcecdf73c6c" } }, { "@timestamp": "2021-05-05T15:30:51.708Z", "log": { "level": "information" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "level": "information", "event_data": { "ProcessId": "2736", "QueryName": "rtb0.doubleverify.com", "QueryStatus": "0", "QueryResults": "type: 5 bs-geo.dvgtm.akadns.net;type: 5 nycp-hlb.dvgtm.akadns.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:07.721", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "time_created": "2019-07-18T03:34:08.054Z", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "record_id": 175, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5 }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:08.054327300Z'/\u003e\u003cEventRecordID\u003e175\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:07.721\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ertb0.doubleverify.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 bs-geo.dvgtm.akadns.net;type: 5 nycp-hlb.dvgtm.akadns.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.709Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:08.054344600Z'/\u003e\u003cEventRecordID\u003e176\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:07.774\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003edev.virtualearth.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 platform.maps.glbdns2.microsoft.com;type: 5 fe-bmplatform-prod-atm.trafficmanager.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 176, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:08.054Z", "level": "information", "event_data": { "QueryName": "dev.virtualearth.net", "QueryStatus": "0", "QueryResults": "type: 5 platform.maps.glbdns2.microsoft.com;type: 5 fe-bmplatform-prod-atm.trafficmanager.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:07.774", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "computer_name": "vagrant-2016", "opcode": "Info" } }, { "@timestamp": "2021-05-05T15:30:51.709Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:08.054356200Z'/\u003e\u003cEventRecordID\u003e177\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:07.847\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003et.ssl.ak.dynamic.tiles.virtualearth.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 t.ssl.ak.dynamic.tiles.virtualearth.net.edgekey.net;type: 5 e7622.g.akamaiedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "opcode": "Info", "version": 5, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:08.054Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 177, "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:07.847", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "t.ssl.ak.dynamic.tiles.virtualearth.net", "QueryStatus": "0", "QueryResults": "type: 5 t.ssl.ak.dynamic.tiles.virtualearth.net.edgekey.net;type: 5 e7622.g.akamaiedge.net;::ffff:89.160.20.156;" }, "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.709Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:08.054411600Z'/\u003e\u003cEventRecordID\u003e178\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:07.943\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003erp.gwallet.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;192.168.51.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "log": { "level": "information" }, "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "version": 5, "level": "information", "event_data": { "QueryName": "rp.gwallet.com", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;192.168.51.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:07.943", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "time_created": "2019-07-18T03:34:08.054Z", "user": { "identifier": "S-1-5-18" }, "process": { "thread": { "id": 1684 }, "pid": 2828 }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "record_id": 178, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" } }, { "@timestamp": "2021-05-05T15:30:51.709Z", "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:08.054422900Z'/\u003e\u003cEventRecordID\u003e179\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:07.945\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eads.yahoo.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 fo-fd-world-new.yax.gysm.yahoodns.net;::ffff:89.160.20.156;::ffff:81.2.69.143;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" }, "winlog": { "event_data": { "QueryName": "ads.yahoo.com", "QueryStatus": "0", "QueryResults": "type: 5 fo-fd-world-new.yax.gysm.yahoodns.net;::ffff:89.160.20.156;::ffff:81.2.69.143;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:07.945", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 179, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "computer_name": "vagrant-2016", "version": 5, "time_created": "2019-07-18T03:34:08.054Z", "process": { "thread": { "id": 1684 }, "pid": 2828 } }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.709Z", "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:08.054432800Z'/\u003e\u003cEventRecordID\u003e180\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:07.954\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eum.simpli.fi\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" }, "log": { "level": "information" }, "winlog": { "time_created": "2019-07-18T03:34:08.054Z", "level": "information", "event_data": { "UtcTime": "2019-07-18 03:34:07.954", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "um.simpli.fi", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 180, "computer_name": "vagrant-2016", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } } }, "agent": { "type": "filebeat", "version": "8.0.0", "ephemeral_id": "bdc6a4f9-ab87-41e0-a64e-bbcecdf73c6c", "id": "f0224db8-40a9-4f00-b117-333ddd1bc45b", "name": "mbp.local" } }, { "@timestamp": "2021-05-05T15:30:51.709Z", "winlog": { "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "version": 5, "time_created": "2019-07-18T03:34:08.054Z", "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 181, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:07.955", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "mpp.vindicosuite.com" }, "process": { "pid": 2828, "thread": { "id": 1684 } } }, "log": { "level": "information" }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:08.054444800Z'/\u003e\u003cEventRecordID\u003e181\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:07.955\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003empp.vindicosuite.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" } }, { "@timestamp": "2021-05-05T15:30:51.709Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:08.054454600Z'/\u003e\u003cEventRecordID\u003e182\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:07.955\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003esync.1rx.io\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "user": { "identifier": "S-1-5-18" }, "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:07.955", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "sync.1rx.io", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "time_created": "2019-07-18T03:34:08.054Z", "level": "information", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 182, "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5 } }, { "@timestamp": "2021-05-05T15:30:51.709Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:08.054464900Z'/\u003e\u003cEventRecordID\u003e183\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:07.956\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003esync.teads.tv\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 sync.teads.tv.edgekey.net;type: 5 e9957.g.akamaiedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" }, "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "version": 5, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:08.054Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessId": "2736", "QueryName": "sync.teads.tv", "QueryStatus": "0", "QueryResults": "type: 5 sync.teads.tv.edgekey.net;type: 5 e9957.g.akamaiedge.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:07.956", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "record_id": 183, "computer_name": "vagrant-2016" } }, { "@timestamp": "2021-05-05T15:30:51.709Z", "winlog": { "event_id": "22", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "time_created": "2019-07-18T03:34:08.054Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:08.019", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "s.thebrighttag.com", "QueryStatus": "0", "QueryResults": "type: 5 td.thebrighttag.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 184, "opcode": "Info", "version": 5 }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:08.054482800Z'/\u003e\u003cEventRecordID\u003e184\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.019\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003es.thebrighttag.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 td.thebrighttag.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.709Z", "winlog": { "level": "information", "user": { "identifier": "S-1-5-18" }, "event_id": "22", "record_id": 186, "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "time_created": "2019-07-18T03:34:09.053Z", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "event_data": { "QueryName": "t.a3cloud.net", "QueryStatus": "0", "QueryResults": "type: 5 d386jaag4hn9zl.cloudfront.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:08.050", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.053883400Z'/\u003e\u003cEventRecordID\u003e186\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.050\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003et.a3cloud.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 d386jaag4hn9zl.cloudfront.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.709Z", "log": { "level": "information" }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.053900700Z'/\u003e\u003cEventRecordID\u003e187\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.070\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003etps618.doubleverify.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 nycp-hlb.doubleverify.com;type: 5 nycp-hlb.dvgtm.akadns.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "winlog": { "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:08.070", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "tps618.doubleverify.com", "QueryStatus": "0", "QueryResults": "type: 5 nycp-hlb.doubleverify.com;type: 5 nycp-hlb.dvgtm.akadns.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 187, "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:09.053Z" } }, { "@timestamp": "2021-05-05T15:30:51.710Z", "winlog": { "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "time_created": "2019-07-18T03:34:09.053Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "dpm.demdex.net", "QueryStatus": "0", "QueryResults": "type: 5 gslb-2.demdex.net;type: 5 edge-va6.demdex.net;type: 5 dcs-edge-va6-802167536.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:08.090" }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 188, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } } }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.053914100Z'/\u003e\u003cEventRecordID\u003e188\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.090\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003edpm.demdex.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 gslb-2.demdex.net;type: 5 edge-va6.demdex.net;type: 5 dcs-edge-va6-802167536.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.710Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.053938800Z'/\u003e\u003cEventRecordID\u003e189\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.308\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003esecure.adnxs.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 g.geogslb.com;type: 5 ib.anycast.adnxs.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "version": 5, "time_created": "2019-07-18T03:34:09.053Z", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:08.308", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "secure.adnxs.com", "QueryStatus": "0", "QueryResults": "type: 5 g.geogslb.com;type: 5 ib.anycast.adnxs.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 189 }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.710Z", "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.053949300Z'/\u003e\u003cEventRecordID\u003e190\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.478\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003etps.doubleverify.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 tps-geo.dvgtm.akadns.net;type: 5 nycp-hlb.dvgtm.akadns.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" }, "winlog": { "record_id": 190, "computer_name": "vagrant-2016", "version": 5, "time_created": "2019-07-18T03:34:09.053Z", "user": { "identifier": "S-1-5-18" }, "process": { "thread": { "id": 1684 }, "pid": 2828 }, "provider_name": "Microsoft-Windows-Sysmon", "event_id": "22", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "event_data": { "QueryName": "tps.doubleverify.com", "QueryStatus": "0", "QueryResults": "type: 5 tps-geo.dvgtm.akadns.net;type: 5 nycp-hlb.dvgtm.akadns.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:08.478", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "channel": "Microsoft-Windows-Sysmon/Operational" } }, { "@timestamp": "2021-05-05T15:30:51.710Z", "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.067752300Z'/\u003e\u003cEventRecordID\u003e191\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.536\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ei.liadm.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 idaas-production.us-east-1.elasticbeanstalk.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" }, "winlog": { "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "event_data": { "QueryName": "i.liadm.com", "QueryStatus": "0", "QueryResults": "type: 5 idaas-production.us-east-1.elasticbeanstalk.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:08.536", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "user": { "identifier": "S-1-5-18" }, "record_id": 191, "computer_name": "vagrant-2016", "version": 5, "time_created": "2019-07-18T03:34:09.067Z" } }, { "@timestamp": "2021-05-05T15:30:51.710Z", "log": { "level": "information" }, "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.067766000Z'/\u003e\u003cEventRecordID\u003e192\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.544\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003epixel.s3xified.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;192.168.51.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22" }, "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "record_id": 192, "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "version": 5, "time_created": "2019-07-18T03:34:09.067Z", "level": "information", "event_data": { "QueryResults": "::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;192.168.51.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:08.544", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "pixel.s3xified.com", "QueryStatus": "0" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22" } }, { "@timestamp": "2021-05-05T15:30:51.710Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.067776600Z'/\u003e\u003cEventRecordID\u003e193\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.550\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003erouter.infolinks.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_data": { "UtcTime": "2019-07-18 03:34:08.550", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "router.infolinks.com", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "opcode": "Info", "user": { "identifier": "S-1-5-18" }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 193, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:09.067Z", "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.710Z", "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 194, "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:09.067Z", "level": "information", "event_id": "22", "version": 5, "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessId": "2736", "QueryName": "grey.erne.co", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:08.552", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}" }, "process": { "pid": 2828, "thread": { "id": 1684 } } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.067787900Z'/\u003e\u003cEventRecordID\u003e194\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.552\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003egrey.erne.co\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.710Z", "winlog": { "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "event_data": { "UtcTime": "2019-07-18 03:34:08.552", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "sync.jivox.com", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "version": 5, "time_created": "2019-07-18T03:34:09.067Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 195, "opcode": "Info", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } } }, "log": { "level": "information" }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.067797800Z'/\u003e\u003cEventRecordID\u003e195\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.552\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003esync.jivox.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" } }, { "@timestamp": "2021-05-05T15:30:51.710Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.067819600Z'/\u003e\u003cEventRecordID\u003e196\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.594\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eb1sync.zemanta.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 b1-lsw-use1.zemanta.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:216.160.83.59;::ffff:216.160.83.61;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;192.168.51.30;2a02:cf40:d414::30;192.168.93.30;2a02:cf40:eea3::30;192.168.112.30;2a02:cf40:8cc::30;192.168.172.30;2a02:cf40:39c1::30;192.168.79.30;2a02:cf40:7094::30;192.5\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 196, "opcode": "Info", "channel": "Microsoft-Windows-Sysmon/Operational", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:09.067Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:08.594", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "b1sync.zemanta.com", "QueryStatus": "0", "QueryResults": "type: 5 b1-lsw-use1.zemanta.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:216.160.83.59;::ffff:216.160.83.61;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;2a02:cf40:1ca1::30;192.168.51.30;2a02:cf40:d414::30;192.168.93.30;2a02:cf40:eea3::30;192.168.112.30;2a02:cf40:8cc::30;192.168.172.30;2a02:cf40:39c1::30;192.168.79.30;2a02:cf40:7094::30;192.5", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "computer_name": "vagrant-2016" } }, { "@timestamp": "2021-05-05T15:30:51.711Z", "winlog": { "version": 5, "level": "information", "record_id": 197, "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:09.067Z", "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryName": "tg.socdm.com", "QueryStatus": "0", "QueryResults": "type: 5 tg3.dr.socdm.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:08.619", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "process": { "pid": 2828, "thread": { "id": 1684 } } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.067835500Z'/\u003e\u003cEventRecordID\u003e197\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.619\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003etg.socdm.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 tg3.dr.socdm.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.711Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.067845000Z'/\u003e\u003cEventRecordID\u003e198\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.620\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eprebid.adnxs.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 prebid.appnexusgslb.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 198, "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "time_created": "2019-07-18T03:34:09.067Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryResults": "type: 5 prebid.appnexusgslb.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:08.620", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "prebid.adnxs.com", "QueryStatus": "0" } }, "agent": { "id": "f0224db8-40a9-4f00-b117-333ddd1bc45b", "name": "mbp.local", "type": "filebeat", "version": "8.0.0", "ephemeral_id": "bdc6a4f9-ab87-41e0-a64e-bbcecdf73c6c" } }, { "@timestamp": "2021-05-05T15:30:51.711Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.067883500Z'/\u003e\u003cEventRecordID\u003e199\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.811\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eul1.dvtps.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 tps.doubleverify.com;type: 5 tps-geo.dvgtm.akadns.net;type: 5 nycp-hlb.dvgtm.akadns.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" }, "winlog": { "process": { "pid": 2828, "thread": { "id": 1684 } }, "record_id": 199, "opcode": "Info", "time_created": "2019-07-18T03:34:09.067Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryName": "ul1.dvtps.com", "QueryStatus": "0", "QueryResults": "type: 5 tps.doubleverify.com;type: 5 tps-geo.dvgtm.akadns.net;type: 5 nycp-hlb.dvgtm.akadns.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:08.811", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5 } }, { "@timestamp": "2021-05-05T15:30:51.711Z", "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.067946300Z'/\u003e\u003cEventRecordID\u003e200\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:08.912\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eul1.dvtps.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e9701\u003c/Data\u003e\u003cData Name='QueryResults'\u003e\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:08.912", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ul1.dvtps.com", "QueryStatus": "9701", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 200, "version": 5, "time_created": "2019-07-18T03:34:09.067Z", "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.711Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:09.068003400Z'/\u003e\u003cEventRecordID\u003e201\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:09.016\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003etags.bluekai.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 tags.bluekai.com.edgekey.net;type: 5 e13541.x.akamaiedge.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "22" }, "winlog": { "event_id": "22", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:09.068Z", "level": "information", "event_data": { "UtcTime": "2019-07-18 03:34:09.016", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "tags.bluekai.com", "QueryStatus": "0", "QueryResults": "type: 5 tags.bluekai.com.edgekey.net;type: 5 e13541.x.akamaiedge.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 201, "opcode": "Info", "version": 5, "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.711Z", "log": { "level": "information" }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:10.067467200Z'/\u003e\u003cEventRecordID\u003e202\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:09.048\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ecdnjs.cloudflare.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2016", "level": "information", "event_data": { "UtcTime": "2019-07-18 03:34:09.048", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "cdnjs.cloudflare.com", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" }, "version": 5, "time_created": "2019-07-18T03:34:10.067Z", "user": { "identifier": "S-1-5-18" }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 202, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.711Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:10.067488100Z'/\u003e\u003cEventRecordID\u003e203\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:09.051\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003epixel.onaudience.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "time_created": "2019-07-18T03:34:10.067Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:09.051", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "pixel.onaudience.com" }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 203, "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "process": { "thread": { "id": 1684 }, "pid": 2828 } } }, { "@timestamp": "2021-05-05T15:30:51.711Z", "log": { "level": "information" }, "winlog": { "event_id": "22", "record_id": 204, "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:10.067Z", "level": "information", "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryResults": "type: 5 ocsp.digicert.com;type: 5 cs9.wac.phicdn.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:09.054", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "status.geotrust.com", "QueryStatus": "0" }, "process": { "pid": 2828, "thread": { "id": 1684 } } }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:10.067504600Z'/\u003e\u003cEventRecordID\u003e204\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:09.054\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003estatus.geotrust.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 ocsp.digicert.com;type: 5 cs9.wac.phicdn.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.711Z", "winlog": { "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "opcode": "Info", "process": { "pid": 2828, "thread": { "id": 1684 } }, "record_id": 205, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:10.067Z", "event_data": { "UtcTime": "2019-07-18 03:34:09.126", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ocsp.trust-provider.com", "QueryStatus": "0", "QueryResults": "type: 5 t3j2g9x7.stackpathcdn.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:10.067529300Z'/\u003e\u003cEventRecordID\u003e205\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:09.126\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eocsp.trust-provider.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 t3j2g9x7.stackpathcdn.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.711Z", "log": { "level": "information" }, "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:10.067550800Z'/\u003e\u003cEventRecordID\u003e206\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:09.184\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eocsp.comodoca4.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 t3j2g9x7.stackpathcdn.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "winlog": { "time_created": "2019-07-18T03:34:10.067Z", "event_data": { "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ocsp.comodoca4.com", "QueryStatus": "0", "QueryResults": "type: 5 t3j2g9x7.stackpathcdn.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:09.184" }, "event_id": "22", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "record_id": 206, "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "process": { "pid": 2828, "thread": { "id": 1684 } } }, "agent": { "id": "f0224db8-40a9-4f00-b117-333ddd1bc45b", "name": "mbp.local", "type": "filebeat", "version": "8.0.0", "ephemeral_id": "bdc6a4f9-ab87-41e0-a64e-bbcecdf73c6c" } }, { "@timestamp": "2021-05-05T15:30:51.711Z", "winlog": { "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "record_id": 207, "computer_name": "vagrant-2016", "event_data": { "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "sync.crwdcntrl.net", "QueryStatus": "0", "QueryResults": "type: 5 td.crwdcntrl.net;type: 5 nginx-bcp-stackB-428666447.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:09.322" }, "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "time_created": "2019-07-18T03:34:10.067Z", "process": { "pid": 2828, "thread": { "id": 1684 } } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:10.067594200Z'/\u003e\u003cEventRecordID\u003e207\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:09.322\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003esync.crwdcntrl.net\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 td.crwdcntrl.net;type: 5 nginx-bcp-stackB-428666447.us-east-1.elb.amazonaws.com;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.712Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:10.067634800Z'/\u003e\u003cEventRecordID\u003e208\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:09.730\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ematch.sync.ad.cpe.dotomi.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 cpe.us.dotomi.weighted.com.akadns.net;type: 5 cpe.us.iad.dotomi.weighted.com.akadns.net;type: 5 iad04-convex.dotomi.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "time_created": "2019-07-18T03:34:10.067Z", "level": "information", "event_data": { "QueryName": "match.sync.ad.cpe.dotomi.com", "QueryStatus": "0", "QueryResults": "type: 5 cpe.us.dotomi.weighted.com.akadns.net;type: 5 cpe.us.iad.dotomi.weighted.com.akadns.net;type: 5 iad04-convex.dotomi.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:09.730", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "user": { "identifier": "S-1-5-18" }, "event_id": "22", "record_id": 208, "computer_name": "vagrant-2016", "opcode": "Info" } }, { "@timestamp": "2021-05-05T15:30:51.712Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:11.066534000Z'/\u003e\u003cEventRecordID\u003e209\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:10.627\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003etps10230.doubleverify.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 nycp-hlb.doubleverify.com;type: 5 nycp-hlb.dvgtm.akadns.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "version": 5, "time_created": "2019-07-18T03:34:11.066Z", "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 209, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:10.627", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "tps10230.doubleverify.com", "QueryStatus": "0", "QueryResults": "type: 5 nycp-hlb.doubleverify.com;type: 5 nycp-hlb.dvgtm.akadns.net;::ffff:89.160.20.156;" } }, "agent": { "id": "f0224db8-40a9-4f00-b117-333ddd1bc45b", "name": "mbp.local", "type": "filebeat", "version": "8.0.0", "ephemeral_id": "bdc6a4f9-ab87-41e0-a64e-bbcecdf73c6c" } }, { "@timestamp": "2021-05-05T15:30:51.712Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:11.066558700Z'/\u003e\u003cEventRecordID\u003e210\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:10.650\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003etps10221.doubleverify.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 nycp-hlb.doubleverify.com;type: 5 nycp-hlb.dvgtm.akadns.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "record_id": 210, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:11.066Z", "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "tps10221.doubleverify.com", "QueryStatus": "0", "QueryResults": "type: 5 nycp-hlb.doubleverify.com;type: 5 nycp-hlb.dvgtm.akadns.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:10.650" }, "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant-2016" }, "agent": { "id": "f0224db8-40a9-4f00-b117-333ddd1bc45b", "name": "mbp.local", "type": "filebeat", "version": "8.0.0", "ephemeral_id": "bdc6a4f9-ab87-41e0-a64e-bbcecdf73c6c" } }, { "@timestamp": "2021-05-05T15:30:51.712Z", "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "record_id": 212, "computer_name": "vagrant-2016", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "QueryStatus": "0", "QueryResults": "type: 5 star-mini.c10r.facebook.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:16.329", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "www.facebook.com" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2019-07-18T03:34:17.272Z" }, "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:17.272022200Z'/\u003e\u003cEventRecordID\u003e212\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:16.329\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ewww.facebook.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 star-mini.c10r.facebook.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;192.168.94.30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" } }, { "@timestamp": "2021-05-05T15:30:51.712Z", "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:17.272102900Z'/\u003e\u003cEventRecordID\u003e213\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:16.386\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eplatform.twitter.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 cs472.wac.edgecastcdn.net;type: 5 cs1-apr-8315.wac.edgecastcdn.net;type: 5 wac.apr-8315.edgecastdns.net;type: 5 cs1-lb-us.8315.ecdns.net;type: 5 cs491.wac.edgecastcdn.net;::ffff:192.168.163.25;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "version": 5, "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 213, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:17.272Z", "level": "information", "event_data": { "QueryStatus": "0", "QueryResults": "type: 5 cs472.wac.edgecastcdn.net;type: 5 cs1-apr-8315.wac.edgecastcdn.net;type: 5 wac.apr-8315.edgecastdns.net;type: 5 cs1-lb-us.8315.ecdns.net;type: 5 cs491.wac.edgecastcdn.net;::ffff:192.168.163.25;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:16.386", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "platform.twitter.com" }, "event_id": "22", "computer_name": "vagrant-2016", "opcode": "Info" }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.712Z", "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:17.272134300Z'/\u003e\u003cEventRecordID\u003e214\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:16.482\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003esyndication.twitter.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003e::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22" }, "winlog": { "version": 5, "time_created": "2019-07-18T03:34:17.272Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "record_id": 214, "computer_name": "vagrant-2016", "event_data": { "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:16.482", "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "syndication.twitter.com", "QueryStatus": "0", "QueryResults": "::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;192.168.80.30;2a02:cf40:856e::30;" } }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.712Z", "winlog": { "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "ProcessGuid": "{fa4a0de6-e8a9-5d2f-0000-001053699900}", "ProcessId": "2736", "QueryName": "ade.googlesyndication.com", "QueryStatus": "0", "QueryResults": "type: 5 pagead.l.doubleclick.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:34:19.578" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 215, "computer_name": "vagrant-2016", "version": 5, "time_created": "2019-07-18T03:34:21.552Z", "process": { "pid": 2828, "thread": { "id": 1684 } } }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:21.552490900Z'/\u003e\u003cEventRecordID\u003e215\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:19.578\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003eade.googlesyndication.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 pagead.l.doubleclick.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:51.712Z", "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:33.148104300Z'/\u003e\u003cEventRecordID\u003e216\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:31.219\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a8-5d2f-0000-001094619900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e356\u003c/Data\u003e\u003cData Name='QueryName'\u003eiecvlist.microsoft.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 ie9comview.vo.msecnd.net;type: 5 cs9.wpc.v0cdn.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event" }, "log": { "level": "information" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "record_id": 216, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:34:33.148Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2019-07-18 03:34:31.219", "ProcessGuid": "{fa4a0de6-e8a8-5d2f-0000-001094619900}", "ProcessId": "356", "QueryName": "iecvlist.microsoft.com", "QueryStatus": "0", "QueryResults": "type: 5 ie9comview.vo.msecnd.net;type: 5 cs9.wpc.v0cdn.net;::ffff:89.160.20.156;", "Image": "C:\\Program Files\\Internet Explorer\\iexplore.exe" }, "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "opcode": "Info", "version": 5, "level": "information", "process": { "thread": { "id": 1684 }, "pid": 2828 } } }, { "@timestamp": "2021-05-05T15:30:51.712Z", "winlog": { "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "event_data": { "UtcTime": "2019-07-18 03:39:02.752", "ProcessGuid": "{fa4a0de6-b1a2-5d2f-0000-00106aca0000}", "ProcessId": "844", "QueryName": "tsfe.trafficshaping.dsp.mp.microsoft.com", "QueryStatus": "0", "QueryResults": "type: 5 tsfe.trafficmanager.net;::ffff:89.160.20.156;", "Image": "C:\\Windows\\System32\\svchost.exe" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "record_id": 220, "computer_name": "vagrant-2016", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "time_created": "2019-07-18T03:39:03.685Z", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:39:03.685690200Z'/\u003e\u003cEventRecordID\u003e220\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:39:02.752\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-b1a2-5d2f-0000-00106aca0000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e844\u003c/Data\u003e\u003cData Name='QueryName'\u003etsfe.trafficshaping.dsp.mp.microsoft.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 tsfe.trafficmanager.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.712Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:39:22.432153100Z'/\u003e\u003cEventRecordID\u003e221\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:39:20.413\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-b1a2-5d2f-0000-00106aca0000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e844\u003c/Data\u003e\u003cData Name='QueryName'\u003eisatap.local.crowbird.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e9003\u003c/Data\u003e\u003cData Name='QueryResults'\u003e\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:39:22.432Z", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 221, "opcode": "Info", "version": 5, "level": "information", "event_data": { "QueryStatus": "9003", "Image": "C:\\Windows\\System32\\svchost.exe", "UtcTime": "2019-07-18 03:39:20.413", "ProcessGuid": "{fa4a0de6-b1a2-5d2f-0000-00106aca0000}", "ProcessId": "844", "QueryName": "isatap.local.crowbird.com" }, "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.713Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:39:42.554539300Z'/\u003e\u003cEventRecordID\u003e230\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:39:40.504\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e9f7-5d2f-0000-001031039c00}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e676\u003c/Data\u003e\u003cData Name='QueryName'\u003epuppet\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e9003\u003c/Data\u003e\u003cData Name='QueryResults'\u003e\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files\\Puppet Labs\\Puppet\\sys\\ruby\\bin\\ruby.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_id": "22", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:39:42.554Z", "event_data": { "UtcTime": "2019-07-18 03:39:40.504", "ProcessGuid": "{fa4a0de6-e9f7-5d2f-0000-001031039c00}", "ProcessId": "676", "QueryName": "puppet", "QueryStatus": "9003", "Image": "C:\\Program Files\\Puppet Labs\\Puppet\\sys\\ruby\\bin\\ruby.exe" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 230, "opcode": "Info", "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.713Z", "log": { "level": "information" }, "event": { "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:40:42.447293700Z'/\u003e\u003cEventRecordID\u003e231\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:40:40.433\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-b1a2-5d2f-0000-001016f70000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e636\u003c/Data\u003e\u003cData Name='QueryName'\u003ewpad\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e9003\u003c/Data\u003e\u003cData Name='QueryResults'\u003e\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e" }, "winlog": { "version": 5, "event_data": { "QueryName": "wpad", "QueryStatus": "9003", "Image": "C:\\Windows\\System32\\svchost.exe", "UtcTime": "2019-07-18 03:40:40.433", "ProcessGuid": "{fa4a0de6-b1a2-5d2f-0000-001016f70000}", "ProcessId": "636" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "record_id": 231, "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "provider_name": "Microsoft-Windows-Sysmon", "time_created": "2019-07-18T03:40:42.447Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.713Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:42:55.556826000Z'/\u003e\u003cEventRecordID\u003e232\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:42:54.033\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-b1a3-5d2f-0000-00102f440100}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e1788\u003c/Data\u003e\u003cData Name='QueryName'\u003ev10.vortex-win.data.microsoft.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 v10-win.vortex.data.microsoft.com.akadns.net;type: 5 geo.vortex.data.microsoft.com.akadns.net;type: 5 bn2.vortex.data.microsoft.com.akadns.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "version": 5, "level": "information", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 2828, "thread": { "id": 1684 } }, "event_id": "22", "computer_name": "vagrant-2016", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2019-07-18T03:42:55.556Z", "event_data": { "UtcTime": "2019-07-18 03:42:54.033", "ProcessGuid": "{fa4a0de6-b1a3-5d2f-0000-00102f440100}", "ProcessId": "1788", "QueryName": "v10.vortex-win.data.microsoft.com", "QueryStatus": "0", "QueryResults": "type: 5 v10-win.vortex.data.microsoft.com.akadns.net;type: 5 geo.vortex.data.microsoft.com.akadns.net;type: 5 bn2.vortex.data.microsoft.com.akadns.net;::ffff:89.160.20.156;", "Image": "C:\\Windows\\System32\\svchost.exe" }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 232 } }, { "@timestamp": "2021-05-05T15:30:51.713Z", "winlog": { "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "process": { "thread": { "id": 1684 }, "pid": 2828 }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "opcode": "Info", "event_data": { "QueryResults": "type: 5 settingsfd-geo.trafficmanager.net;::ffff:89.160.20.156;", "Image": "C:\\Windows\\System32\\svchost.exe", "UtcTime": "2019-07-18 03:43:04.400", "ProcessGuid": "{fa4a0de6-b1a3-5d2f-0000-00102f440100}", "ProcessId": "1788", "QueryName": "settings-win.data.microsoft.com", "QueryStatus": "0" }, "record_id": 233, "computer_name": "vagrant-2016", "time_created": "2019-07-18T03:43:06.459Z", "user": { "identifier": "S-1-5-18" } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:43:06.459986800Z'/\u003e\u003cEventRecordID\u003e233\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:43:04.400\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-b1a3-5d2f-0000-00102f440100}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e1788\u003c/Data\u003e\u003cData Name='QueryName'\u003esettings-win.data.microsoft.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 settingsfd-geo.trafficmanager.net;::ffff:89.160.20.156;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.695Z", "winlog": { "time_created": "2020-10-27T20:00:14.324Z", "level": "information", "event_data": { "LogonId": "0x2c9e7", "ParentImage": "C:\\Windows\\explorer.exe", "Image": "C:\\Windows\\System32\\notepad.exe", "Description": "Notepad", "LogonGuid": "{9f32b55f-6fdd-5f98-e7c9-020000000000}", "TerminalSessionId": "1", "ProcessId": "3616", "Product": "Microsoft« Windows« Operating System", "ProcessGuid": "{9f32b55f-7c4e-5f98-5803-000000000500}", "FileVersion": "10.0.17763.475 (WinBuild.160101.0800)", "Company": "Microsoft Corporation", "CommandLine": "\"C:\\Windows\\system32\\notepad.exe\" ", "Hashes": "SHA1=B6D237154F2E528F0B503B58B025862D66B02B73", "ParentProcessId": "4212", "RuleName": "-", "UtcTime": "2020-10-27 20:00:14.320", "User": "VAGRANT\\vagrant", "IntegrityLevel": "Medium", "ParentProcessGuid": "{9f32b55f-6fdf-5f98-7000-000000000500}", "ParentCommandLine": "C:\\Windows\\Explorer.EXE", "OriginalFileName": "NOTEPAD.EXE", "CurrentDirectory": "C:\\Users\\vagrant\\" }, "process": { "pid": 7144, "thread": { "id": 6876 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "version": 5, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" }, "event_id": "1", "record_id": 20, "computer_name": "vagrant" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e1\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e1\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-10-27T20:00:14.324234100Z'/\u003e\u003cEventRecordID\u003e20\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='7144' ThreadID='6876'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e-\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2020-10-27 20:00:14.320\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{9f32b55f-7c4e-5f98-5803-000000000500}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e3616\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\notepad.exe\u003c/Data\u003e\u003cData Name='FileVersion'\u003e10.0.17763.475 (WinBuild.160101.0800)\u003c/Data\u003e\u003cData Name='Description'\u003eNotepad\u003c/Data\u003e\u003cData Name='Product'\u003eMicrosoft« Windows« Operating System\u003c/Data\u003e\u003cData Name='Company'\u003eMicrosoft Corporation\u003c/Data\u003e\u003cData Name='OriginalFileName'\u003eNOTEPAD.EXE\u003c/Data\u003e\u003cData Name='CommandLine'\u003e\"C:\\Windows\\system32\\notepad.exe\" \u003c/Data\u003e\u003cData Name='CurrentDirectory'\u003eC:\\Users\\vagrant\\\u003c/Data\u003e\u003cData Name='User'\u003eVAGRANT\\vagrant\u003c/Data\u003e\u003cData Name='LogonGuid'\u003e{9f32b55f-6fdd-5f98-e7c9-020000000000}\u003c/Data\u003e\u003cData Name='LogonId'\u003e0x2c9e7\u003c/Data\u003e\u003cData Name='TerminalSessionId'\u003e1\u003c/Data\u003e\u003cData Name='IntegrityLevel'\u003eMedium\u003c/Data\u003e\u003cData Name='Hashes'\u003eSHA1=B6D237154F2E528F0B503B58B025862D66B02B73\u003c/Data\u003e\u003cData Name='ParentProcessGuid'\u003e{9f32b55f-6fdf-5f98-7000-000000000500}\u003c/Data\u003e\u003cData Name='ParentProcessId'\u003e4212\u003c/Data\u003e\u003cData Name='ParentImage'\u003eC:\\Windows\\explorer.exe\u003c/Data\u003e\u003cData Name='ParentCommandLine'\u003eC:\\Windows\\Explorer.EXE\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "1", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.696Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e25\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e25\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2021-02-25T14:43:23.551269400Z'/\u003e\u003cEventRecordID\u003e10737797\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='3800' ThreadID='5080'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003eDESKTOP-I9CQVAQ\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e-\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2021-02-25 14:43:23.550\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{9497d8d9-b78b-6037-6f13-000000001000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2628\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files\\Git\\mingw64\\libexec\\git-core\\git.exe\u003c/Data\u003e\u003cData Name='Type'\u003eImage is replaced\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "25", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "time_created": "2021-02-25T14:43:23.551Z", "level": "information", "event_data": { "ProcessId": "2628", "Image": "C:\\Program Files\\Git\\mingw64\\libexec\\git-core\\git.exe", "Type": "Image is replaced", "RuleName": "-", "UtcTime": "2021-02-25 14:43:23.550", "ProcessGuid": "{9497d8d9-b78b-6037-6f13-000000001000}" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "25", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "DESKTOP-I9CQVAQ", "version": 5, "process": { "pid": 3800, "thread": { "id": 5080 } }, "record_id": 10737797, "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18" } }, "host": { "name": "DESKTOP-I9CQVAQ" } }, { "@timestamp": "2021-05-05T15:30:51.692Z", "winlog": { "time_created": "2020-05-12T06:48:27.084Z", "level": "information", "user": { "identifier": "S-1-5-18" }, "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2012-r2", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "23", "record_id": 2243, "event_data": { "UtcTime": "2020-05-12 06:48:27.084", "User": "NT AUTHORITY\\SYSTEM", "Image": "C:\\Windows\\system32\\svchost.exe", "TargetFilename": "C:\\Windows\\System32\\LogFiles\\Scm\\8b34f644-f627-47e7-98e0-957ba1c5eb6d", "Hashes": "MD5=5A9BDDF83BE530B481F0FD24DB28A6FF,IMPHASH=00000000000000000000000000000000", "RuleName": "-", "ProcessGuid": "{42f11c3b-4664-5eba-91ae-000000000000}", "ProcessId": "820", "IsExecutable": "false", "Archived": "true" }, "process": { "thread": { "id": 1600 }, "pid": 1188 } }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e23\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e23\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-12T06:48:27.084044200Z'/\u003e\u003cEventRecordID\u003e2243\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='1188' ThreadID='1600'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e-\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2020-05-12 06:48:27.084\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-4664-5eba-91ae-000000000000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e820\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\SYSTEM\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\system32\\svchost.exe\u003c/Data\u003e\u003cData Name='TargetFilename'\u003eC:\\Windows\\System32\\LogFiles\\Scm\\8b34f644-f627-47e7-98e0-957ba1c5eb6d\u003c/Data\u003e\u003cData Name='Hashes'\u003eMD5=5A9BDDF83BE530B481F0FD24DB28A6FF,IMPHASH=00000000000000000000000000000000\u003c/Data\u003e\u003cData Name='IsExecutable'\u003efalse\u003c/Data\u003e\u003cData Name='Archived'\u003etrue\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "23", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.694Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e7\u003c/EventID\u003e\u003cVersion\u003e3\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e7\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-10-28T02:39:26.388325200Z'/\u003e\u003cEventRecordID\u003e10685\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='1676' ThreadID='4796'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e-\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2020-10-28 02:39:26.374\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{9f32b55f-d9de-5f98-f006-000000000600}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e5184\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\dllhost.exe\u003c/Data\u003e\u003cData Name='ImageLoaded'\u003eC:\\Windows\\System32\\IDStore.dll\u003c/Data\u003e\u003cData Name='FileVersion'\u003e10.0.17763.1 (WinBuild.160101.0800)\u003c/Data\u003e\u003cData Name='Description'\u003eIdentity Store\u003c/Data\u003e\u003cData Name='Product'\u003eMicrosoft« Windows« Operating System\u003c/Data\u003e\u003cData Name='Company'\u003eMicrosoft Corporation\u003c/Data\u003e\u003cData Name='OriginalFileName'\u003eIdStore.dll\u003c/Data\u003e\u003cData Name='Hashes'\u003eSHA1=9955A1C071C44A7CEECC0D928A9CFB7F64CC3F93,MD5=C7C45610F644906E6F7D664EF2E45B08,SHA256=4808F1101F4E42387D8DDB7A355668BAE3BF6F781C42D3BCD82E23446B1DEB3E,IMPHASH=194F3797B52231028C718B6D776C6853\u003c/Data\u003e\u003cData Name='Signed'\u003etrue\u003c/Data\u003e\u003cData Name='Signature'\u003eMicrosoft Windows\u003c/Data\u003e\u003cData Name='SignatureStatus'\u003eValid\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "7", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_id": "7", "provider_name": "Microsoft-Windows-Sysmon", "version": 3, "level": "information", "process": { "pid": 1676, "thread": { "id": 4796 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2020-10-28T02:39:26.388Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "UtcTime": "2020-10-28 02:39:26.374", "ProcessGuid": "{9f32b55f-d9de-5f98-f006-000000000600}", "Hashes": "SHA1=9955A1C071C44A7CEECC0D928A9CFB7F64CC3F93,MD5=C7C45610F644906E6F7D664EF2E45B08,SHA256=4808F1101F4E42387D8DDB7A355668BAE3BF6F781C42D3BCD82E23446B1DEB3E,IMPHASH=194F3797B52231028C718B6D776C6853", "Signed": "true", "SignatureStatus": "Valid", "ProcessId": "5184", "Image": "C:\\Windows\\System32\\dllhost.exe", "Description": "Identity Store", "Product": "Microsoft« Windows« Operating System", "Company": "Microsoft Corporation", "RuleName": "-", "OriginalFileName": "IdStore.dll", "ImageLoaded": "C:\\Windows\\System32\\IDStore.dll", "FileVersion": "10.0.17763.1 (WinBuild.160101.0800)", "Signature": "Microsoft Windows" }, "record_id": 10685 } }, { "@timestamp": "2021-05-05T15:30:51.693Z", "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 2691, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 2, "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "Image": "C:\\Windows\\Explorer.EXE", "TargetObject": "HKU\\S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\HRZR_PGYFRFFVBA", "Details": "Binary Data", "RuleName": "-", "EventType": "SetValue", "UtcTime": "2020-05-05 14:57:46.808", "ProcessGuid": "{5b522f6e-7554-5eb1-6d00-000000000800}", "ProcessId": "4320" }, "process": { "pid": 5496, "thread": { "id": 876 } }, "event_id": "13", "computer_name": "vagrant", "opcode": "Info", "time_created": "2020-05-05T14:57:46.818Z" }, "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e13\u003c/EventID\u003e\u003cVersion\u003e2\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e13\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-05T14:57:46.818869100Z'/\u003e\u003cEventRecordID\u003e2691\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='5496' ThreadID='876'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e-\u003c/Data\u003e\u003cData Name='EventType'\u003eSetValue\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2020-05-05 14:57:46.808\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{5b522f6e-7554-5eb1-6d00-000000000800}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e4320\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\Explorer.EXE\u003c/Data\u003e\u003cData Name='TargetObject'\u003eHKU\\S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\HRZR_PGYFRFFVBA\u003c/Data\u003e\u003cData Name='Details'\u003eBinary Data\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "13", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.695Z", "host": { "name": "DESKTOP-I9CQVAQ" }, "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e24\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e24\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2021-02-25T15:04:48.607343500Z'/\u003e\u003cEventRecordID\u003e10757412\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='3800' ThreadID='6444'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003eDESKTOP-I9CQVAQ\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e-\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2021-02-25 15:04:48.592\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{9497d8d9-aa1b-602f-a600-000000001000}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2144\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe\u003c/Data\u003e\u003cData Name='Session'\u003e1\u003c/Data\u003e\u003cData Name='ClientInfo'\u003euser: DESKTOP-I9CQVAQ\\luks\u003c/Data\u003e\u003cData Name='Hashes'\u003eSHA256=7ADB1CF1A75973079C055F929573AE92557A8C0E5B0E38A6A5427E412FB73D59,IMPHASH=00000000000000000000000000000000\u003c/Data\u003e\u003cData Name='Archived'\u003etrue\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "24" }, "log": { "level": "information" }, "winlog": { "record_id": 10757412, "opcode": "Info", "time_created": "2021-02-25T15:04:48.607Z", "user": { "identifier": "S-1-5-18" }, "process": { "pid": 3800, "thread": { "id": 6444 } }, "event_id": "24", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "DESKTOP-I9CQVAQ", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "level": "information", "event_data": { "Image": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe", "Session": "1", "ClientInfo": "user: DESKTOP-I9CQVAQ\\luks", "Archived": "true", "RuleName": "-", "UtcTime": "2021-02-25 15:04:48.592", "Hashes": "SHA256=7ADB1CF1A75973079C055F929573AE92557A8C0E5B0E38A6A5427E412FB73D59,IMPHASH=00000000000000000000000000000000", "ProcessGuid": "{9497d8d9-aa1b-602f-a600-000000001000}", "ProcessId": "2144" }, "channel": "Microsoft-Windows-Sysmon/Operational" } }, { "@timestamp": "2021-05-05T15:30:51.705Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e2\u003c/EventID\u003e\u003cVersion\u003e4\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e2\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-03-18T16:57:52.433367300Z'/\u003e\u003cEventRecordID\u003e32\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='4860' ThreadID='4516'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2012-r2\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-03-18 16:57:52.433\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{42f11c3b-ccaa-5c8f-0000-0010b4e22700}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e1600\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\u003c/Data\u003e\u003cData Name='TargetFilename'\u003eC:\\Users\\vagrant\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Storage\\ext\\gfdkimpbcpahaombhbimeihdjnejgicl\\def\\ee4a6e45-bffd-49f4-98ae-32aebcc890b5.tmp\u003c/Data\u003e\u003cData Name='CreationUtcTime'\u003e2019-03-18 16:52:05.339\u003c/Data\u003e\u003cData Name='PreviousCreationUtcTime'\u003e2019-03-18 16:57:52.417\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "2", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "winlog": { "event_id": "2", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "level": "information", "user": { "identifier": "S-1-5-18" }, "event_data": { "CreationUtcTime": "2019-03-18 16:52:05.339", "PreviousCreationUtcTime": "2019-03-18 16:57:52.417", "UtcTime": "2019-03-18 16:57:52.433", "ProcessGuid": "{42f11c3b-ccaa-5c8f-0000-0010b4e22700}", "ProcessId": "1600", "Image": "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe", "TargetFilename": "C:\\Users\\vagrant\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Storage\\ext\\gfdkimpbcpahaombhbimeihdjnejgicl\\def\\ee4a6e45-bffd-49f4-98ae-32aebcc890b5.tmp" }, "process": { "pid": 4860, "thread": { "id": 4516 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 32, "computer_name": "vagrant-2012-r2", "version": 4, "time_created": "2019-03-18T16:57:52.433Z", "provider_name": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-05-05T15:30:51.713Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:49:52.105632700Z'/\u003e\u003cEventRecordID\u003e234\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:49:51.154\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a8-5d2f-0000-001094619900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e356\u003c/Data\u003e\u003cData Name='QueryName'\u003ec.urs.microsoft.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 wd-prod-ss.trafficmanager.net;type: 5 wd-prod-ss-us-east-1-fe.eastus.cloudapp.azure.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "22", "kind": "event" }, "winlog": { "time_created": "2019-07-18T03:49:52.105Z", "user": { "identifier": "S-1-5-18" }, "event_data": { "Image": "C:\\Program Files\\Internet Explorer\\iexplore.exe", "UtcTime": "2019-07-18 03:49:51.154", "ProcessGuid": "{fa4a0de6-e8a8-5d2f-0000-001094619900}", "ProcessId": "356", "QueryName": "c.urs.microsoft.com", "QueryStatus": "0", "QueryResults": "type: 5 wd-prod-ss.trafficmanager.net;type: 5 wd-prod-ss-us-east-1-fe.eastus.cloudapp.azure.com;::ffff:89.160.20.156;192.168.6.30;2a02:cf40:a83e::2:30;192.168.14.30;2a02:cf40:231d::2:30;192.168.92.30;2a02:cf40:83eb::30;" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "22", "provider_name": "Microsoft-Windows-Sysmon", "computer_name": "vagrant-2016", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "record_id": 234, "opcode": "Info", "version": 5, "level": "information", "process": { "pid": 2828, "thread": { "id": 1684 } } } }, { "@timestamp": "2021-05-05T15:30:51.724Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e26\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e26\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2022-01-24T05:12:34.329980300Z'/\u003e\u003cEventRecordID\u003e456\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2764' ThreadID='3792'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e-\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2022-01-24 05:12:34.328\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{63a74932-a2b4-61ee-1b00-000000000700}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e1264\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\LOCAL SERVICE\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\System32\\svchost.exe\u003c/Data\u003e\u003cData Name='TargetFilename'\u003eC:\\Windows\\ServiceState\\EventLog\\Data\\lastalive1.dat\u003c/Data\u003e\u003cData Name='Hashes'\u003eSHA256=A94808E7C66973B122F66EC6611019C745A9602F8E944F53635CAB58AEF35A79\u003c/Data\u003e\u003cData Name='IsExecutable'\u003efalse\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "26", "kind": "event" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { "Hashes": "SHA256=A94808E7C66973B122F66EC6611019C745A9602F8E944F53635CAB58AEF35A79", "Image": "C:\\Windows\\System32\\svchost.exe", "IsExecutable": "false", "ProcessGuid": "{63a74932-a2b4-61ee-1b00-000000000700}", "ProcessId": "1264", "RuleName": "-", "TargetFilename": "C:\\Windows\\ServiceState\\EventLog\\Data\\lastalive1.dat", "User": "NT AUTHORITY\\LOCAL SERVICE", "UtcTime": "2022-01-24 05:12:34.328" }, "event_id": "26", "level": "information", "opcode": "Info", "process": { "pid": 2764, "thread": { "id": 3792 } }, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 456, "time_created": "2022-01-24T05:12:34.3299803Z", "user": { "identifier": "S-1-5-18" }, "version": 5 } }, { "@timestamp": "2021-05-05T15:30:51.731Z", "log": { "level": "information" }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e26\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e26\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2022-01-24T05:12:51.042270000Z'/\u003e\u003cEventRecordID\u003e457\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2764' ThreadID='3792'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e-\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2022-01-24 05:12:51.031\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{63a74932-3523-61ee-af00-000000000700}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e1364\u003c/Data\u003e\u003cData Name='User'\u003eNT AUTHORITY\\SYSTEM\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\system32\\svchost.exe\u003c/Data\u003e\u003cData Name='TargetFilename'\u003eC:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\OLDCACHE.000\u003c/Data\u003e\u003cData Name='Hashes'\u003eSHA256=D78FBF654D84DDF2CB4FE221F7D8B61E0DECDEE48A4687915E6E4A2296E2418B\u003c/Data\u003e\u003cData Name='IsExecutable'\u003efalse\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "26", "kind": "event" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { "Hashes": "SHA256=D78FBF654D84DDF2CB4FE221F7D8B61E0DECDEE48A4687915E6E4A2296E2418B", "Image": "C:\\Windows\\system32\\svchost.exe", "IsExecutable": "false", "ProcessGuid": "{63a74932-3523-61ee-af00-000000000700}", "ProcessId": "1364", "RuleName": "-", "TargetFilename": "C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataCache\\OLDCACHE.000", "User": "NT AUTHORITY\\SYSTEM", "UtcTime": "2022-01-24 05:12:51.031" }, "event_id": "26", "level": "information", "opcode": "Info", "process": { "pid": 2764, "thread": { "id": 3792 } }, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 457, "time_created": "2022-01-24T05:12:51.04227Z", "user": { "identifier": "S-1-5-18" }, "version": 5 } }, { "@timestamp": "2022-03-31T06:21:03.771Z", "event": { "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e13\u003c/EventID\u003e\u003cVersion\u003e2\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e13\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2022-03-31T06:21:03.771061300Z'/\u003e\u003cEventRecordID\u003e9334\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2876' ThreadID='3720'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003eUACMe Dir Prep\u003c/Data\u003e\u003cData Name='EventType'\u003eSetValue\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2022-03-31 06:21:03.765\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{ce6f2a55-427a-6245-3801-000000000900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e5816\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\regedit.exe\u003c/Data\u003e\u003cData Name='TargetObject'\u003eHKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_QWORD\u003c/Data\u003e\u003cData Name='Details'\u003eQWORD (0x00000000-0x1234fabd)\u003c/Data\u003e\u003cData Name='User'\u003eVAGRANT\\vagrant\u003c/Data\u003e\u003c/EventData\u003e\u003cRenderingInfo Culture='en-US'\u003e\u003cMessage\u003eRegistry value set:\r\nRuleName: UACMe Dir Prep\r\nEventType: SetValue\r\nUtcTime: 2022-03-31 06:21:03.765\r\nProcessGuid: {ce6f2a55-427a-6245-3801-000000000900}\r\nProcessId: 5816\r\nImage: C:\\Windows\\regedit.exe\r\nTargetObject: HKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_QWORD\r\nDetails: QWORD (0x00000000-0x1234fabd)\r\nUser: VAGRANT\\vagrant\u003c/Message\u003e\u003cLevel\u003eInformation\u003c/Level\u003e\u003cTask\u003eRegistry value set (rule: RegistryEvent)\u003c/Task\u003e\u003cOpcode\u003eInfo\u003c/Opcode\u003e\u003cChannel\u003e\u003c/Channel\u003e\u003cProvider\u003e\u003c/Provider\u003e\u003cKeywords\u003e\u003c/Keywords\u003e\u003c/RenderingInfo\u003e\u003c/Event\u003e", "action": "Registry value set (rule: RegistryEvent)", "created": "2022-03-31T06:21:05.221Z", "code": "13", "dataset": "windows.sysmon_operational" }, "log": { "level": "information" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "event_data": { "TargetObject": "HKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_QWORD", "Details": "QWORD (0x00000000-0x1234fabd)", "Image": "C:\\Windows\\regedit.exe", "User": "VAGRANT\\vagrant", "RuleName": "UACMe Dir Prep", "EventType": "SetValue", "UtcTime": "2022-03-31 06:21:03.765", "ProcessId": "5816", "ProcessGuid": "{ce6f2a55-427a-6245-3801-000000000900}" }, "api": "wineventlog", "record_id": 9334, "event_id": "13", "provider_name": "Microsoft-Windows-Sysmon", "task": "Registry value set (rule: RegistryEvent)", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 2, "user": { "name": "SYSTEM", "type": "User", "identifier": "S-1-5-18", "domain": "NT AUTHORITY" }, "process": { "pid": 2876, "thread": { "id": 3720 } }, "opcode": "Info", "computer_name": "vagrant" } }, { "@timestamp": "2022-03-31T06:39:22.648Z", "winlog": { "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "user": { "identifier": "S-1-5-18", "domain": "NT AUTHORITY", "name": "SYSTEM", "type": "User" }, "process": { "thread": { "id": 3720 }, "pid": 2876 }, "opcode": "Info", "channel": "Microsoft-Windows-Sysmon/Operational", "record_id": 9366, "task": "Registry value set (rule: RegistryEvent)", "provider_name": "Microsoft-Windows-Sysmon", "event_id": "13", "version": 2, "event_data": { "RuleName": "UACMe Dir Prep", "Details": "abcd", "EventType": "SetValue", "ProcessId": "5816", "Image": "C:\\Windows\\regedit.exe", "UtcTime": "2022-03-31 06:39:22.643", "TargetObject": "HKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_KEY_1", "User": "VAGRANT\\vagrant", "ProcessGuid": "{ce6f2a55-427a-6245-3801-000000000900}" }, "api": "wineventlog", "computer_name": "vagrant" }, "event": { "dataset": "windows.sysmon_operational", "action": "Registry value set (rule: RegistryEvent)", "created": "2022-03-31T06:39:24.670Z", "code": "13", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e13\u003c/EventID\u003e\u003cVersion\u003e2\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e13\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2022-03-31T06:39:22.648698100Z'/\u003e\u003cEventRecordID\u003e9366\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2876' ThreadID='3720'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003eUACMe Dir Prep\u003c/Data\u003e\u003cData Name='EventType'\u003eSetValue\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2022-03-31 06:39:22.643\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{ce6f2a55-427a-6245-3801-000000000900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e5816\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\regedit.exe\u003c/Data\u003e\u003cData Name='TargetObject'\u003eHKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_KEY_1\u003c/Data\u003e\u003cData Name='Details'\u003eabcd\u003c/Data\u003e\u003cData Name='User'\u003eVAGRANT\\vagrant\u003c/Data\u003e\u003c/EventData\u003e\u003cRenderingInfo Culture='en-US'\u003e\u003cMessage\u003eRegistry value set:\r\nRuleName: UACMe Dir Prep\r\nEventType: SetValue\r\nUtcTime: 2022-03-31 06:39:22.643\r\nProcessGuid: {ce6f2a55-427a-6245-3801-000000000900}\r\nProcessId: 5816\r\nImage: C:\\Windows\\regedit.exe\r\nTargetObject: HKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_KEY_1\r\nDetails: abcd\r\nUser: VAGRANT\\vagrant\u003c/Message\u003e\u003cLevel\u003eInformation\u003c/Level\u003e\u003cTask\u003eRegistry value set (rule: RegistryEvent)\u003c/Task\u003e\u003cOpcode\u003eInfo\u003c/Opcode\u003e\u003cChannel\u003e\u003c/Channel\u003e\u003cProvider\u003e\u003c/Provider\u003e\u003cKeywords\u003e\u003c/Keywords\u003e\u003c/RenderingInfo\u003e\u003c/Event\u003e" }, "log": { "level": "information" } }, { "@timestamp": "2022-03-31T06:39:36.303Z", "winlog": { "user": { "name": "SYSTEM", "type": "User", "identifier": "S-1-5-18", "domain": "NT AUTHORITY" }, "process": { "pid": 2876, "thread": { "id": 3720 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "13", "computer_name": "vagrant", "opcode": "Info", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 9370, "task": "Registry value set (rule: RegistryEvent)", "event_data": { "RuleName": "UACMe Dir Prep", "EventType": "SetValue", "UtcTime": "2022-03-31 06:39:36.298", "Details": "DWORD (0x12349abc)", "User": "VAGRANT\\vagrant", "ProcessId": "5816", "TargetObject": "HKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_DWORD", "ProcessGuid": "{ce6f2a55-427a-6245-3801-000000000900}", "Image": "C:\\Windows\\regedit.exe" }, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "api": "wineventlog", "version": 2 }, "log": { "level": "information" }, "event": { "code": "13", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "dataset": "windows.sysmon_operational", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e13\u003c/EventID\u003e\u003cVersion\u003e2\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e13\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2022-03-31T06:39:36.303809800Z'/\u003e\u003cEventRecordID\u003e9370\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2876' ThreadID='3720'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003eUACMe Dir Prep\u003c/Data\u003e\u003cData Name='EventType'\u003eSetValue\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2022-03-31 06:39:36.298\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{ce6f2a55-427a-6245-3801-000000000900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e5816\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\regedit.exe\u003c/Data\u003e\u003cData Name='TargetObject'\u003eHKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_DWORD\u003c/Data\u003e\u003cData Name='Details'\u003eDWORD (0x12349abc)\u003c/Data\u003e\u003cData Name='User'\u003eVAGRANT\\vagrant\u003c/Data\u003e\u003c/EventData\u003e\u003cRenderingInfo Culture='en-US'\u003e\u003cMessage\u003eRegistry value set:\r\nRuleName: UACMe Dir Prep\r\nEventType: SetValue\r\nUtcTime: 2022-03-31 06:39:36.298\r\nProcessGuid: {ce6f2a55-427a-6245-3801-000000000900}\r\nProcessId: 5816\r\nImage: C:\\Windows\\regedit.exe\r\nTargetObject: HKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_DWORD\r\nDetails: DWORD (0x12349abc)\r\nUser: VAGRANT\\vagrant\u003c/Message\u003e\u003cLevel\u003eInformation\u003c/Level\u003e\u003cTask\u003eRegistry value set (rule: RegistryEvent)\u003c/Task\u003e\u003cOpcode\u003eInfo\u003c/Opcode\u003e\u003cChannel\u003e\u003c/Channel\u003e\u003cProvider\u003e\u003c/Provider\u003e\u003cKeywords\u003e\u003c/Keywords\u003e\u003c/RenderingInfo\u003e\u003c/Event\u003e", "action": "Registry value set (rule: RegistryEvent)", "created": "2022-03-31T06:39:37.779Z" } }, { "@timestamp": "2022-03-31T06:40:11.539Z", "winlog": { "event_id": "13", "user": { "name": "SYSTEM", "type": "User", "identifier": "S-1-5-18", "domain": "NT AUTHORITY" }, "api": "wineventlog", "channel": "Microsoft-Windows-Sysmon/Operational", "event_data": { "User": "VAGRANT\\vagrant", "Details": "Binary Data", "ProcessGuid": "{ce6f2a55-427a-6245-3801-000000000900}", "TargetObject": "HKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_MULTI_VALUE_STRING", "EventType": "SetValue", "ProcessId": "5816", "Image": "C:\\Windows\\regedit.exe", "UtcTime": "2022-03-31 06:40:11.534", "RuleName": "UACMe Dir Prep" }, "record_id": 9375, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 2, "computer_name": "vagrant", "process": { "pid": 2876, "thread": { "id": 3720 } }, "opcode": "Info", "provider_name": "Microsoft-Windows-Sysmon", "task": "Registry value set (rule: RegistryEvent)" }, "event": { "code": "13", "dataset": "windows.sysmon_operational", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e13\u003c/EventID\u003e\u003cVersion\u003e2\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e13\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2022-03-31T06:40:11.539166700Z'/\u003e\u003cEventRecordID\u003e9375\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2876' ThreadID='3720'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003eUACMe Dir Prep\u003c/Data\u003e\u003cData Name='EventType'\u003eSetValue\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2022-03-31 06:40:11.534\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{ce6f2a55-427a-6245-3801-000000000900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e5816\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\regedit.exe\u003c/Data\u003e\u003cData Name='TargetObject'\u003eHKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_MULTI_VALUE_STRING\u003c/Data\u003e\u003cData Name='Details'\u003eBinary Data\u003c/Data\u003e\u003cData Name='User'\u003eVAGRANT\\vagrant\u003c/Data\u003e\u003c/EventData\u003e\u003cRenderingInfo Culture='en-US'\u003e\u003cMessage\u003eRegistry value set:\r\nRuleName: UACMe Dir Prep\r\nEventType: SetValue\r\nUtcTime: 2022-03-31 06:40:11.534\r\nProcessGuid: {ce6f2a55-427a-6245-3801-000000000900}\r\nProcessId: 5816\r\nImage: C:\\Windows\\regedit.exe\r\nTargetObject: HKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_MULTI_VALUE_STRING\r\nDetails: Binary Data\r\nUser: VAGRANT\\vagrant\u003c/Message\u003e\u003cLevel\u003eInformation\u003c/Level\u003e\u003cTask\u003eRegistry value set (rule: RegistryEvent)\u003c/Task\u003e\u003cOpcode\u003eInfo\u003c/Opcode\u003e\u003cChannel\u003e\u003c/Channel\u003e\u003cProvider\u003e\u003c/Provider\u003e\u003cKeywords\u003e\u003c/Keywords\u003e\u003c/RenderingInfo\u003e\u003c/Event\u003e", "action": "Registry value set (rule: RegistryEvent)", "created": "2022-03-31T06:40:13.047Z" }, "log": { "level": "information" } }, { "@timestamp": "2022-03-31T06:40:38.118Z", "log": { "level": "information" }, "winlog": { "task": "Registry value set (rule: RegistryEvent)", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "opcode": "Info", "event_data": { "User": "VAGRANT\\vagrant", "RuleName": "UACMe Dir Prep", "EventType": "SetValue", "UtcTime": "2022-03-31 06:40:38.113", "ProcessGuid": "{ce6f2a55-427a-6245-3801-000000000900}", "ProcessId": "5816", "Details": "Binary Data", "Image": "C:\\Windows\\regedit.exe", "TargetObject": "HKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_BIN_VALUE" }, "process": { "pid": 2876, "thread": { "id": 3720 } }, "api": "wineventlog", "provider_name": "Microsoft-Windows-Sysmon", "version": 2, "user": { "identifier": "S-1-5-18", "domain": "NT AUTHORITY", "name": "SYSTEM", "type": "User" }, "event_id": "13", "record_id": 9379 }, "event": { "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e13\u003c/EventID\u003e\u003cVersion\u003e2\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e13\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2022-03-31T06:40:38.118474300Z'/\u003e\u003cEventRecordID\u003e9379\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2876' ThreadID='3720'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003eUACMe Dir Prep\u003c/Data\u003e\u003cData Name='EventType'\u003eSetValue\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2022-03-31 06:40:38.113\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{ce6f2a55-427a-6245-3801-000000000900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e5816\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\regedit.exe\u003c/Data\u003e\u003cData Name='TargetObject'\u003eHKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_BIN_VALUE\u003c/Data\u003e\u003cData Name='Details'\u003eBinary Data\u003c/Data\u003e\u003cData Name='User'\u003eVAGRANT\\vagrant\u003c/Data\u003e\u003c/EventData\u003e\u003cRenderingInfo Culture='en-US'\u003e\u003cMessage\u003eRegistry value set:\r\nRuleName: UACMe Dir Prep\r\nEventType: SetValue\r\nUtcTime: 2022-03-31 06:40:38.113\r\nProcessGuid: {ce6f2a55-427a-6245-3801-000000000900}\r\nProcessId: 5816\r\nImage: C:\\Windows\\regedit.exe\r\nTargetObject: HKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_BIN_VALUE\r\nDetails: Binary Data\r\nUser: VAGRANT\\vagrant\u003c/Message\u003e\u003cLevel\u003eInformation\u003c/Level\u003e\u003cTask\u003eRegistry value set (rule: RegistryEvent)\u003c/Task\u003e\u003cOpcode\u003eInfo\u003c/Opcode\u003e\u003cChannel\u003e\u003c/Channel\u003e\u003cProvider\u003e\u003c/Provider\u003e\u003cKeywords\u003e\u003c/Keywords\u003e\u003c/RenderingInfo\u003e\u003c/Event\u003e", "action": "Registry value set (rule: RegistryEvent)", "dataset": "windows.sysmon_operational", "created": "2022-03-31T06:40:39.262Z", "code": "13", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2022-03-31T06:41:01.551Z", "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "provider_name": "Microsoft-Windows-Sysmon", "event_id": "13", "opcode": "Info", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "process": { "pid": 2876, "thread": { "id": 3720 } }, "task": "Registry value set (rule: RegistryEvent)", "user": { "domain": "NT AUTHORITY", "name": "SYSTEM", "type": "User", "identifier": "S-1-5-18" }, "version": 2, "event_data": { "RuleName": "UACMe Dir Prep", "Image": "C:\\Windows\\regedit.exe", "EventType": "SetValue", "UtcTime": "2022-03-31 06:41:01.546", "ProcessId": "5816", "TargetObject": "HKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_EXPANDED_STR", "Details": "*.dll expanded", "User": "VAGRANT\\vagrant", "ProcessGuid": "{ce6f2a55-427a-6245-3801-000000000900}" }, "api": "wineventlog", "record_id": 9384 }, "event": { "provider": "Microsoft-Windows-Sysmon", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e13\u003c/EventID\u003e\u003cVersion\u003e2\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e13\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2022-03-31T06:41:01.551493500Z'/\u003e\u003cEventRecordID\u003e9384\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2876' ThreadID='3720'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003eUACMe Dir Prep\u003c/Data\u003e\u003cData Name='EventType'\u003eSetValue\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2022-03-31 06:41:01.546\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{ce6f2a55-427a-6245-3801-000000000900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e5816\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Windows\\regedit.exe\u003c/Data\u003e\u003cData Name='TargetObject'\u003eHKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_EXPANDED_STR\u003c/Data\u003e\u003cData Name='Details'\u003e*.dll expanded\u003c/Data\u003e\u003cData Name='User'\u003eVAGRANT\\vagrant\u003c/Data\u003e\u003c/EventData\u003e\u003cRenderingInfo Culture='en-US'\u003e\u003cMessage\u003eRegistry value set:\r\nRuleName: UACMe Dir Prep\r\nEventType: SetValue\r\nUtcTime: 2022-03-31 06:41:01.546\r\nProcessGuid: {ce6f2a55-427a-6245-3801-000000000900}\r\nProcessId: 5816\r\nImage: C:\\Windows\\regedit.exe\r\nTargetObject: HKU\\S-1-5-21-2788380046-4280556519-4095830112-1000\\Volatile Environment\\2\\TEST_EXPANDED_STR\r\nDetails: *.dll expanded\r\nUser: VAGRANT\\vagrant\u003c/Message\u003e\u003cLevel\u003eInformation\u003c/Level\u003e\u003cTask\u003eRegistry value set (rule: RegistryEvent)\u003c/Task\u003e\u003cOpcode\u003eInfo\u003c/Opcode\u003e\u003cChannel\u003e\u003c/Channel\u003e\u003cProvider\u003e\u003c/Provider\u003e\u003cKeywords\u003e\u003c/Keywords\u003e\u003c/RenderingInfo\u003e\u003c/Event\u003e", "action": "Registry value set (rule: RegistryEvent)", "dataset": "windows.sysmon_operational", "created": "2022-03-31T06:41:03.491Z", "code": "13", "kind": "event" }, "log": { "level": "information" } }, { "@timestamp": "2021-05-05T15:30:52.731Z", "winlog": { "event_id": "1", "level": "information", "computer_name": "vagrant-2012-r2", "opcode": "Info", "provider_guid": "{9990385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5, "time_created": "2022-01-24T05:12:52.04227Z", "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 3, "user": { "identifier": "S-1-5-18" }, "event_data": { "RuleName": "-", "UtcTime": "2022-04-27 18:13:46.501", "ProcessGuid": "{34B92076-87DA-6269-16EE-240000002800}", "ProcessId": "8232", "Image": "C:\\Windows\\System32\\cmd.exe", "FileVersion": "10.0.14393.0 (rs1_release.160715-1616)", "Description": "Windows Command Processor", "Product": "Microsoft® Windows® Operating System", "Company": "Microsoft Corporation", "OriginalFileName": "Cmd.Exe", "CommandLine": "\u0026quot;C:\\Windows\\system32\\cmd.exe\u0026quot; /c SQLCMD -S \u0026quot;X\u0026quot; -h -1 -Q \u0026quot;EXEC DBA.dbo.AGSYNC_ALERT\u0026quot; \u0026gt; C:\\tmp\\SQL_ASYNCMonitor.txt", "CurrentDirectory": "C:\\Windows\\system32\\", "User": "DOMAIN\\user", "LogonGuid": "{99999999-3A6F-6235-680C-030000000000}", "LogonId": "0x30c68", "TerminalSessionId": "0", "IntegrityLevel": "High", "Hashes": "MD5=999999996175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2", "ParentProcessGuid": "{00000000-0000-0000-0000-000000000000}", "ParentProcessId": "5060", "ParentImage": "-", "ParentCommandLine": "-", "ParentUser": "-" }, "process": { "pid": 4860, "thread": { "id": 4516 } } }, "log": { "level": "information" }, "event": { "code": "1", "kind": "event", "provider": "Microsoft-Windows-Sysmon" } }, { "@timestamp": "2021-10-24T06:35:26.449Z", "winlog": { "computer_name": "MSEDGEWIN10", "process": { "pid": 3428, "thread": { "id": 4688 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_data": { "Company": "Microsoft Corporation", "LogonGuid": "{747f3d96-f9b3-6174-0000-00207edf3900}", "Description": "Windows Problem Reporting", "IntegrityLevel": "Medium", "TerminalSessionId": "1", "FileVersion": "10.0.17763.1339 (WinBuild.160101.0800)", "Product": "Microsoft® Windows® Operating System", "LogonId": "0x39df7e" }, "opcode": "Info", "version": 5, "record_id": "561649", "task": "Process Create (rule: ProcessCreate)", "event_id": "1", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "api": "wineventlog", "provider_name": "Microsoft-Windows-Sysmon", "user": { "identifier": "S-1-5-18", "domain": "NT AUTHORITY", "name": "SYSTEM", "type": "User" } }, "log": { "level": "information" }, "event": { "agent_id_status": "verified", "ingested": "2021-10-24T06:35:29Z", "code": "1", "provider": "Microsoft-Windows-Sysmon", "created": "2021-10-24T06:35:27.362Z", "kind": "event", "action": "Process Create (rule: ProcessCreate)", "category": [ "process" ], "type": [ "start" ], "dataset": "windows.sysmon_operational" } }, { "@timestamp": "2021-10-24T06:35:26.460Z", "winlog": { "computer_name": "MSEDGEWIN10", "process": { "pid": 3428, "thread": { "id": 4688 } }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_data": { "GrantedAccess": "0x1fffff", "TargetProcessId": "24700", "TargetImage": "C:\\Windows\\System32\\WerFault.exe", "CallTrace": "C:\\Windows\\SYSTEM32\\ntdll.dll+a0fb4|C:\\Windows\\System32\\KERNELBASE.dll+485d2|C:\\Windows\\System32\\KERNELBASE.dll+45eaa|C:\\Windows\\System32\\KERNELBASE.dll+45a36|C:\\Windows\\System32\\KERNEL32.DLL+1c153|UNKNOWN(00007FFE11374AAE)", "TargetProcessGUID": "{747f3d96-feae-6174-0000-00106ad39a00}" }, "opcode": "Info", "version": 3, "record_id": "561650", "event_id": "10", "task": "Process accessed (rule: ProcessAccess)", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "api": "wineventlog", "provider_name": "Microsoft-Windows-Sysmon", "user": { "identifier": "S-1-5-18", "domain": "NT AUTHORITY", "name": "SYSTEM", "type": "User" } }, "log": { "level": "information" }, "event": { "agent_id_status": "verified", "ingested": "2021-10-24T06:35:29Z", "code": "10", "provider": "Microsoft-Windows-Sysmon", "created": "2021-10-24T06:35:27.469Z", "kind": "event", "action": "Process accessed (rule: ProcessAccess)", "category": [ "process" ], "type": [ "access" ], "dataset": "windows.sysmon_operational" } }, { "@timestamp": "2023-03-10T16:41:26.119Z", "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "provider_name": "Microsoft-Windows-Sysmon", "version": 2, "record_id": 739823, "computer_name": "rfsH.lab.local", "event_data": { "TargetProcessGuid": "{A23EAE89-8E5A-5917-0000-00100E3E4D04}", "TargetProcessId": "2024", "UtcTime": "2017-05-13 22:53:43.214", "StartFunction": "DbgUiRemoteBreakin", "StartModule": "C:\\Windows\\SYSTEM32\\ntdll.dll", "TargetImage": "C:\\repos\\Supercharger\\Mtg.Supercharger.ControllerService\\bin\\x64\\Debug\\Mtg.Supercharger.ControllerService.exe", "SourceProcessId": "8804", "StartAddress": "0x00007FFB09321970", "NewThreadId": "20532", "SourceImage": "C:\\Program Files (x86)\\Microsoft Visual Studio 14.0\\Common7\\IDE\\Remote Debugger\\x64\\msvsmon.exe", "SourceProcessGuid": "{A23EAE89-8E6D-5917-0000-0010DFAF5004}" }, "event_id": "8", "level": "information", "opcode": "Info", "process": { "pid": 2848, "thread": { "id": 3520 } }, "provider_guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}", "time_created": "2017-05-13T22:53:43.2148643Z", "user": { "identifier": "S-1-5-18" } }, "event": { "original": "\u003cEvent xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"\u003e\u003cSystem\u003e\u003cProvider Name=\"Microsoft-Windows-Sysmon\" Guid=\"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}\" /\u003e\u003cEventID\u003e8\u003c/EventID\u003e\u003cVersion\u003e2\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e8\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime=\"2017-05-13T22:53:43.214864300Z\" /\u003e\u003cEventRecordID\u003e739823\u003c/EventRecordID\u003e\u003cCorrelation /\u003e\u003cExecution ProcessID=\"2848\" ThreadID=\"3520\" /\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003erfsH.lab.local\u003c/Computer\u003e\u003cSecurity UserID=\"S-1-5-18\" /\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name=\"UtcTime\"\u003e2017-05-13 22:53:43.214\u003c/Data\u003e\u003cData Name=\"SourceProcessGuid\"\u003e{A23EAE89-8E6D-5917-0000-0010DFAF5004}\u003c/Data\u003e\u003cData Name=\"SourceProcessId\"\u003e8804\u003c/Data\u003e\u003cData Name=\"SourceImage\"\u003eC:\\Program Files (x86)\\Microsoft Visual Studio 14.0\\Common7\\IDE\\Remote Debugger\\x64\\msvsmon.exe\u003c/Data\u003e\u003cData Name=\"TargetProcessGuid\"\u003e{A23EAE89-8E5A-5917-0000-00100E3E4D04}\u003c/Data\u003e\u003cData Name=\"TargetProcessId\"\u003e2024\u003c/Data\u003e\u003cData Name=\"TargetImage\"\u003eC:\\repos\\Supercharger\\Mtg.Supercharger.ControllerService\\bin\\x64\\Debug\\Mtg.Supercharger.ControllerService.exe\u003c/Data\u003e\u003cData Name=\"NewThreadId\"\u003e20532\u003c/Data\u003e\u003cData Name=\"StartAddress\"\u003e0x00007FFB09321970\u003c/Data\u003e\u003cData Name=\"StartModule\"\u003eC:\\Windows\\SYSTEM32\\ntdll.dll\u003c/Data\u003e\u003cData Name=\"StartFunction\"\u003eDbgUiRemoteBreakin\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "8", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "host": { "name": "rfsH.lab.local" }, "log": { "level": "information" } }, { "@timestamp": "2023-03-10T16:44:49.726Z", "winlog": { "time_created": "2018-03-22T20:32:22.3337787Z", "version": 2, "event_data": { "ProcessId": "4", "UtcTime": "2018-03-22 20:32:22.332", "Device": "\\Device\\HarddiskVolume2", "Image": "System", "ProcessGuid": "{A23EAE89-C65F-5AB2-0000-0010EB030000}" }, "event_id": "9", "level": "information", "opcode": "Info", "process": { "pid": 19572, "thread": { "id": 21888 } }, "record_id": 1944686, "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "rfsH.lab.local", "provider_guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}", "provider_name": "Microsoft-Windows-Sysmon", "user": { "identifier": "S-1-5-18" } }, "event": { "original": "\u003cEvent xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"\u003e\u003cSystem\u003e\u003cProvider Name=\"Microsoft-Windows-Sysmon\" Guid=\"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}\" /\u003e\u003cEventID\u003e9\u003c/EventID\u003e\u003cVersion\u003e2\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e9\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime=\"2018-03-22T20:32:22.333778700Z\" /\u003e\u003cEventRecordID\u003e1944686\u003c/EventRecordID\u003e\u003cCorrelation /\u003e\u003cExecution ProcessID=\"19572\" ThreadID=\"21888\" /\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003erfsH.lab.local\u003c/Computer\u003e\u003cSecurity UserID=\"S-1-5-18\" /\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name=\"UtcTime\"\u003e2018-03-22 20:32:22.332\u003c/Data\u003e\u003cData Name=\"ProcessGuid\"\u003e{A23EAE89-C65F-5AB2-0000-0010EB030000}\u003c/Data\u003e\u003cData Name=\"ProcessId\"\u003e4\u003c/Data\u003e\u003cData Name=\"Image\"\u003eSystem\u003c/Data\u003e\u003cData Name=\"Device\"\u003e\\Device\\HarddiskVolume2\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "9", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "host": { "name": "rfsH.lab.local" }, "log": { "level": "information" } }, { "@timestamp": "2023-03-10T16:46:23.102Z", "winlog": { "level": "information", "opcode": "Info", "provider_guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}", "time_created": "2018-04-11T16:26:16.3276987Z", "user": { "identifier": "S-1-5-18" }, "version": 3, "event_data": { "EventNamespace": " \"root\\\\cimv2\"", "EventType": "WmiFilterEvent", "Name": " \"BotFilter82\"", "Operation": "Created", "Query": " \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime \u003e= 200 AND TargetInstance.SystemUpTime \u003c 320\"", "User": "LAB\\rsmith", "UtcTime": "2018-04-11 16:26:16.327" }, "computer_name": "rfsh.lab.local", "event_id": "19", "process": { "pid": 7620, "thread": { "id": 21880 } }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 63551, "channel": "Microsoft-Windows-Sysmon/Operational" }, "event": { "original": "\u003cEvent xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"\u003e\u003cSystem\u003e\u003cProvider Name=\"Microsoft-Windows-Sysmon\" Guid=\"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}\" /\u003e\u003cEventID\u003e19\u003c/EventID\u003e\u003cVersion\u003e3\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e19\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime=\"2018-04-11T16:26:16.327698700Z\" /\u003e\u003cEventRecordID\u003e63551\u003c/EventRecordID\u003e\u003cCorrelation /\u003e\u003cExecution ProcessID=\"7620\" ThreadID=\"21880\" /\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003erfsh.lab.local\u003c/Computer\u003e\u003cSecurity UserID=\"S-1-5-18\" /\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name=\"EventType\"\u003eWmiFilterEvent\u003c/Data\u003e\u003cData Name=\"UtcTime\"\u003e2018-04-11 16:26:16.327\u003c/Data\u003e\u003cData Name=\"Operation\"\u003eCreated\u003c/Data\u003e\u003cData Name=\"User\"\u003eLAB\\rsmith\u003c/Data\u003e\u003cData Name=\"EventNamespace\"\u003e \"root\\\\cimv2\"\u003c/Data\u003e\u003cData Name=\"Name\"\u003e \"BotFilter82\"\u003c/Data\u003e\u003cData Name=\"Query\"\u003e \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' AND TargetInstance.SystemUpTime \u0026gt;= 200 AND TargetInstance.SystemUpTime \u0026lt; 320\"\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "19", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "host": { "name": "rfsh.lab.local" }, "log": { "level": "information" } }, { "@timestamp": "2023-03-10T16:48:06.865Z", "winlog": { "provider_name": "Microsoft-Windows-Sysmon", "record_id": 63557, "version": 3, "channel": "Microsoft-Windows-Sysmon/Operational", "event_data": { "User": "LAB\\rsmith", "UtcTime": "2018-04-11 16:26:16.360", "Destination": " \"C:\\\\Windows\\\\System32\\\\evil.exe\"", "EventType": "WmiConsumerEvent", "Name": " \"BotConsumer23\"", "Operation": "Created", "Type": "Command Line" }, "provider_guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}", "opcode": "Info", "process": { "pid": 7620, "thread": { "id": 21880 } }, "time_created": "2018-04-11T16:26:16.3604732Z", "user": { "identifier": "S-1-5-18" }, "computer_name": "rfsh.lab.local", "event_id": "20", "level": "information" }, "event": { "original": "\u003cEvent xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"\u003e\u003cSystem\u003e\u003cProvider Name=\"Microsoft-Windows-Sysmon\" Guid=\"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}\" /\u003e\u003cEventID\u003e20\u003c/EventID\u003e\u003cVersion\u003e3\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e20\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime=\"2018-04-11T16:26:16.360473200Z\" /\u003e\u003cEventRecordID\u003e63557\u003c/EventRecordID\u003e\u003cCorrelation /\u003e\u003cExecution ProcessID=\"7620\" ThreadID=\"21880\" /\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003erfsh.lab.local\u003c/Computer\u003e\u003cSecurity UserID=\"S-1-5-18\" /\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name=\"EventType\"\u003eWmiConsumerEvent\u003c/Data\u003e\u003cData Name=\"UtcTime\"\u003e2018-04-11 16:26:16.360\u003c/Data\u003e\u003cData Name=\"Operation\"\u003eCreated\u003c/Data\u003e\u003cData Name=\"User\"\u003eLAB\\rsmith\u003c/Data\u003e\u003cData Name=\"Name\"\u003e \"BotConsumer23\"\u003c/Data\u003e\u003cData Name=\"Type\"\u003eCommand Line\u003c/Data\u003e\u003cData Name=\"Destination\"\u003e \"C:\\\\Windows\\\\System32\\\\evil.exe\"\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "20", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "host": { "name": "rfsh.lab.local" }, "log": { "level": "information" } }, { "@timestamp": "2023-03-10T17:41:38.273Z", "winlog": { "level": "error", "opcode": "Info", "process": { "pid": 1112, "thread": { "id": 1332 } }, "record_id": 278772, "time_created": "2015-01-21T17:00:44.0014533Z", "version": 1, "computer_name": "WIN-RKSC06DQ86F", "event_data": { "Description": "Failed to retrieve events (Last error: Insufficient system resources exist to complete the requested service.).", "ID": "DriverCommunication" }, "provider_guid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}", "provider_name": "Microsoft-Windows-Sysmon", "user": { "identifier": "S-1-5-18" }, "channel": "Microsoft-Windows-Sysmon/Operational", "event_id": "255" }, "event": { "original": "\u003cEvent xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"\u003e\u003cSystem\u003e\u003cProvider Name=\"Microsoft-Windows-Sysmon\" Guid=\"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}\" /\u003e\u003cEventID\u003e255\u003c/EventID\u003e\u003cVersion\u003e1\u003c/Version\u003e\u003cLevel\u003e2\u003c/Level\u003e\u003cTask\u003e255\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime=\"2015-01-21T17:00:44.001453300Z\" /\u003e\u003cEventRecordID\u003e278772\u003c/EventRecordID\u003e\u003cCorrelation /\u003e\u003cExecution ProcessID=\"1112\" ThreadID=\"1332\" /\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003eWIN-RKSC06DQ86F\u003c/Computer\u003e\u003cSecurity UserID=\"S-1-5-18\" /\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name=\"ID\"\u003eDriverCommunication\u003c/Data\u003e\u003cData Name=\"Description\"\u003eFailed to retrieve events (Last error: Insufficient system resources exist to complete the requested service.).\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", "code": "255", "kind": "event" }, "host": { "name": "WIN-RKSC06DQ86F" }, "log": { "level": "error" } }, { "@timestamp": "2023-03-12T08:03:28.403Z", "winlog": { "computer_name": "sample-wind-sysmon", "level": "information", "opcode": "Info", "user": { "identifier": "S-1-5-18" }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 406, "time_created": "2023-03-12T08:01:25.4286552Z", "channel": "Microsoft-Windows-Sysmon/Operational", "event_data": { "Hashes": "SHA256=F2835A7EE42F30AA78659FAE1510F791A38E63480B099CDD20D402760EE7A391", "Image": "C:\\Windows\\Explorer.EXE", "ProcessGuid": "{4299a14b-71fa-640d-bc00-000000000700}", "ProcessId": "868", "RuleName": "fileblocktest", "TargetFilename": "C:\\ProgramData\\notepad.exe", "User": "SAMPLE-WI\\sampleuser", "UtcTime": "2023-03-12 08:01:25.423" }, "event_id": "27", "process": { "pid": 3804, "thread": { "id": 4760 } }, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "version": 5 }, "event": { "original": "\u003cEvent xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"\u003e\u003cSystem\u003e\u003cProvider Name=\"Microsoft-Windows-Sysmon\" Guid=\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\" /\u003e\u003cEventID\u003e27\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e27\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime=\"2023-03-12T08:01:25.4286552Z\" /\u003e\u003cEventRecordID\u003e406\u003c/EventRecordID\u003e\u003cCorrelation /\u003e\u003cExecution ProcessID=\"3804\" ThreadID=\"4760\" /\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003esample-wind-sysmon\u003c/Computer\u003e\u003cSecurity UserID=\"S-1-5-18\" /\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name=\"RuleName\"\u003efileblocktest\u003c/Data\u003e\u003cData Name=\"UtcTime\"\u003e2023-03-12 08:01:25.423\u003c/Data\u003e\u003cData Name=\"ProcessGuid\"\u003e{4299a14b-71fa-640d-bc00-000000000700}\u003c/Data\u003e\u003cData Name=\"ProcessId\"\u003e868\u003c/Data\u003e\u003cData Name=\"User\"\u003eSAMPLE-WI\\sampleuser\u003c/Data\u003e\u003cData Name=\"Image\"\u003eC:\\Windows\\Explorer.EXE\u003c/Data\u003e\u003cData Name=\"TargetFilename\"\u003eC:\\ProgramData\\notepad.exe\u003c/Data\u003e\u003cData Name=\"Hashes\"\u003eSHA256=F2835A7EE42F30AA78659FAE1510F791A38E63480B099CDD20D402760EE7A391\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "27", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "host": { "name": "sample-wind-sysmon" }, "log": { "level": "information" } }, { "@timestamp": "2023-03-12T08:16:19.639Z", "winlog": { "opcode": "Info", "process": { "thread": { "id": 4760 }, "pid": 3804 }, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "time_created": "2023-03-12T08:13:25.3808395Z", "user": { "identifier": "S-1-5-18" }, "computer_name": "sample-wind-sysmon", "event_data": { "Image": "C:\\Windows\\Explorer.EXE", "ProcessGuid": "{4299a14b-71fa-640d-bc00-000000000700}", "ProcessId": "868", "RuleName": "fileblocktest", "TargetFilename": "C:\\Users\\sampleuser\\Music\\notepad.exe", "User": "SAMPLE-WI\\sampleuser", "UtcTime": "2023-03-12 08:13:25.375", "Hashes": "SHA256=F2835A7EE42F30AA78659FAE1510F791A38E63480B099CDD20D402760EE7A391" }, "event_id": "27", "level": "information", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 438, "version": 5, "channel": "Microsoft-Windows-Sysmon/Operational" }, "event": { "original": "\u003cEvent xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"\u003e\u003cSystem\u003e\u003cProvider Name=\"Microsoft-Windows-Sysmon\" Guid=\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\" /\u003e\u003cEventID\u003e27\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e27\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime=\"2023-03-12T08:13:25.3808395Z\" /\u003e\u003cEventRecordID\u003e438\u003c/EventRecordID\u003e\u003cCorrelation /\u003e\u003cExecution ProcessID=\"3804\" ThreadID=\"4760\" /\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003esample-wind-sysmon\u003c/Computer\u003e\u003cSecurity UserID=\"S-1-5-18\" /\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name=\"RuleName\"\u003efileblocktest\u003c/Data\u003e\u003cData Name=\"UtcTime\"\u003e2023-03-12 08:13:25.375\u003c/Data\u003e\u003cData Name=\"ProcessGuid\"\u003e{4299a14b-71fa-640d-bc00-000000000700}\u003c/Data\u003e\u003cData Name=\"ProcessId\"\u003e868\u003c/Data\u003e\u003cData Name=\"User\"\u003eSAMPLE-WI\\sampleuser\u003c/Data\u003e\u003cData Name=\"Image\"\u003eC:\\Windows\\Explorer.EXE\u003c/Data\u003e\u003cData Name=\"TargetFilename\"\u003eC:\\Users\\sampleuser\\Music\\notepad.exe\u003c/Data\u003e\u003cData Name=\"Hashes\"\u003eSHA256=F2835A7EE42F30AA78659FAE1510F791A38E63480B099CDD20D402760EE7A391\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "code": "27", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "host": { "name": "sample-wind-sysmon" }, "log": { "level": "information" } }, { "@timestamp": "2023-03-12T09:23:18.632Z", "winlog": { "user": { "identifier": "S-1-5-18" }, "version": 5, "level": "information", "opcode": "Info", "process": { "pid": 3804, "thread": { "id": 4760 } }, "provider_name": "Microsoft-Windows-Sysmon", "record_id": 583, "time_created": "2023-03-12T09:20:46.9436239Z", "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "sample-wind-sysmon", "event_data": { "IsExecutable": "true", "TargetFilename": "C:\\Users\\sample\\Downloads\\ChromeSetup (1).exe", "User": "SAMPLE-WI\\sample", "UtcTime": "2023-03-12 09:20:46.943", "Hashes": "SHA256=8DDCCA3D2A78660524D73C51DD148DE7B76DF1573EBCC8C5B2AC36FDE2FF2396", "Image": "C:\\Users\\sample\\Downloads\\SDelete\\sdelete64.exe", "ProcessGuid": "{4299a14b-996c-640d-8d02-000000000700}", "ProcessId": "6788", "RuleName": "fileblockshredtest" }, "event_id": "28", "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" }, "event": { "original": "\u003cEvent xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"\u003e\u003cSystem\u003e\u003cProvider Name=\"Microsoft-Windows-Sysmon\" Guid=\"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\" /\u003e\u003cEventID\u003e28\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e28\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime=\"2023-03-12T09:20:46.9436239Z\" /\u003e\u003cEventRecordID\u003e583\u003c/EventRecordID\u003e\u003cCorrelation /\u003e\u003cExecution ProcessID=\"3804\" ThreadID=\"4760\" /\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003esample-wind-sysmon\u003c/Computer\u003e\u003cSecurity UserID=\"S-1-5-18\" /\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name=\"RuleName\"\u003efileblockshredtest\u003c/Data\u003e\u003cData Name=\"UtcTime\"\u003e2023-03-12 09:20:46.943\u003c/Data\u003e\u003cData Name=\"ProcessGuid\"\u003e{4299a14b-996c-640d-8d02-000000000700}\u003c/Data\u003e\u003cData Name=\"ProcessId\"\u003e6788\u003c/Data\u003e\u003cData Name=\"User\"\u003eSAMPLE-WI\\sample\u003c/Data\u003e\u003cData Name=\"Image\"\u003eC:\\Users\\sample\\Downloads\\SDelete\\sdelete64.exe\u003c/Data\u003e\u003cData Name=\"TargetFilename\"\u003eC:\\Users\\sample\\Downloads\\ChromeSetup (1).exe\u003c/Data\u003e\u003cData Name=\"Hashes\"\u003eSHA256=8DDCCA3D2A78660524D73C51DD148DE7B76DF1573EBCC8C5B2AC36FDE2FF2396\u003c/Data\u003e\u003cData Name=\"IsExecutable\"\u003etrue\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "kind": "event", "provider": "Microsoft-Windows-Sysmon", "code": "28" }, "host": { "name": "sample-wind-sysmon" }, "log": { "level": "information" } }, { "event": { "code": "22", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "host": { "name": "internal.network.org" }, "log": { "level": "information" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "internal.network.org", "event_data": { "Image": "C:\\Windows\\System32\\lsass.exe", "ProcessGuid": "{00000000-0000-0000-0000-000000000000}", "ProcessId": "500", "QueryName": "some.other.domain.com", "QueryResults": "type: 33 ;type: 33 ;81.2.69.144;81.2.69.142;", "QueryStatus": "0", "RuleName": "-", "User": "NT AUTHORITY\\SYSTEM", "UtcTime": "2000-01-01T00:00:00.000" }, "event_id": "22", "level": "information", "opcode": "Info", "process": { "pid": 1000, "thread": { "id": 2000 } }, "provider_guid": "{00000000-0000-0000-0000-000000000000}", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 1111, "time_created": "2000-01-01T00:00:00Z", "user": { "identifier": "A-0-0-00" }, "version": 5 } }, { "event": { "code": "29", "kind": "event", "provider": "Microsoft-Windows-Sysmon" }, "host": { "name": "SEC-TRACE-WinSRV22-Y01" }, "log": { "level": "information" }, "winlog": { "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "SEC-TRACE-WinSRV22-Y01", "event_data": { "Hashes": "SHA1=D48757B74EFF02255F74614F35AA27ABBE3F72C7,MD5=32365E3E64D28CC94756AC9A09B67F06,SHA256=09043C51719D4BF6405C9A7A292BB9BB3BCC782F639B708DDCC4EEDB5E5C9CE9,IMPHASH=1F2627FC453DC35031A9502372BD3549", "Image": "C:\\Windows\\system32\\curl.exe", "ProcessGuid": "{2f280947-3586-649e-5901-000000000e00}", "ProcessId": "3828", "RuleName": "-", "TargetFilename": "C:\\Users\\auruser\\Desktop\\32365e3e64d28cc94756ac9a09b67f06.bin", "User": "SEC-TRACE-WINSR\\auruser", "UtcTime": "2023-06-30 01:53:13.076" }, "event_id": "29", "level": "information", "opcode": "Info", "process": { "pid": 2824, "thread": { "id": 1380 } }, "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", "provider_name": "Microsoft-Windows-Sysmon", "record_id": 679378, "time_created": "2023-06-30T01:53:13.0787986Z", "user": { "identifier": "S-1-5-18" }, "version": 5 } } ] }