| Step | Time | Host | User | Technique | Evidence | |------|------|------|------|-----------|----------| | 1 | 2012-03-13 23:27:24 | WKS-WIN764BITB | SHIELDBASE\rsydow | Network logon (Type 3) from 10.3.58.4 with full admin privileges | EventID 4672+4624, Archive-Security-2012-03-13-22-30-32-081.evtx, Record #838297–838298 | | 2 | 2012-03-13 23:29:25 | WKS-WIN764BITB | SHIELDBASE\rsydow | Created local account SRL-Helpdesk (S-1-5-21-228041085-1601810819-2769380060-1001) | EventID 4720+4722+4728, Archive-Security-2012-03-14-05-34-20-035.evtx, Records #838307–838309 | | 3 | 2012-03-15 22:11:55 | WKS-WIN764BITB | S-1-5-21-...-1114 (rsydow) | Installed kernel driver BCSWAP (C:\Windows\system32\
{
"memory_image": "/home/sansforensics/cases/nfury/win7-64-nfury-memory/win7-64-nfury-memory-raw.001",
"plugin": "windows.hashdump",
"row_count": 5,
"output": "Volatility 3 Framework 2.27.0\nUser\trid\tlmhash\tnthash\nAdministrator\t500\taad3b435b51404eeaad3b435b51404ee\t31d6cfe0d16ae931b73c59d7e0c089c0\nGuest\t501\taad3b435b51404eeaad3b435b51404ee\t31d6cfe0d16ae931b73c59d7e0c089c0\nSRL-Helpdesk\t1001\taad3b435b51404eeaad3b435b51404ee\t4c3f5e9fe4c8fc2f99d47cbb25d7d193",
"truncated": false
}
---
Error executing tool run_terminal_command: 1 validation error for run_terminal_commandArguments
command
Field required [type=missing, input_value={}, input_type=dict]
For further information visit https://errors.pydantic.dev/2.13/v/missing
---
/mnt/nfury/Windows/System32/config/RegBack/SAM
/mnt/nfury/Windows/System32/config/SAM
run_volatilityrun_terminal_commandfind /mnt/nfury -iname 'sam' -o -iname 'fgdump*' -o -iname 'pwdump*' -o -iname 'procdump*' -o -iname 'gsecdump*' -o -iname 'secretsdump*' -o -iname 'wce.exe' -o -iname 'samdump*' 2>/dev/null{
"memory_image": "/home/sansforensics/cases/nfury/win7-64-nfury-memory/win7-64-nfury-memory-raw.001",
"plugin": "windows.hashdump",
"row_count": 5,
"output": "Volatility 3 Framework 2.27.0\nUser\trid\tlmhash\tnthash\nAdministrator\t500\taad3b435b51404eeaad3b435b51404ee\t31d6cfe0d16ae931b73c59d7e0c089c0\nGuest\t501\taad3b435b51404eeaad3b435b51404ee\t31d6cfe0d16ae931b73c59d7e0c089c0\nSRL-Helpdesk\t1001\taad3b435b51404eeaad3b435b51404ee\t4c3f5e9fe4c8fc2f99d47cbb25d7d193",
"truncated": false
}
---
Error executing tool run_terminal_command: 1 validation error for run_terminal_commandArguments
command
Field required [type=missing, input_value={}, input_type=dict]
For further information visit https://errors.pydantic.dev/2.13/v/missing
---
/mnt/nfury/Windows/System32/config/RegBack/SAM
/mnt/nfury/Windows/System32/config/SAM
File: /mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1673/$R6SODDB/svchost.exe Size: 102400 Blocks: 200 IO Block: 4096 regular file Device: 7,11 Inode: 92255 Links: 1 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 17:13:56.460811600 +0000 Modify: 2008-04-14 00:12:36.000000000 +0000 Change: 2012-04-06 18:42:04.171044200 +0000 Birth: - --- !This program cannot be run in DOS mode. Rich .text `.data .reloc bad allocation %s\%s a.exe pause System\CurrentControlSet\Services\netman\domain false true vector<T> too long bad cast ios_base::eofbit set ios_base::failbit set ios_base::badbit set raB3G%p Client threw unexpected error. Client threw error: sending: received: connection.execute() failed in t.f Error calling listen Error calling bind 127.0.0.1 recv_loop exiting! recv_loop recv_data() returned false recv() returned <= 0 exiting run loop on behalf of exitEvent run exiting! send_data() returned false Received id: Error calling accept Received connection! Accepting connections... home http://192.168.1.5/ads/ <value> </value> <boolean> </boolean> <double> </double> <int> </int> <i4> </i4> <string> </string> <dateTime.iso8601> </dateTime.iso8601> <base64> </base64> <array> <data> </data> </array> <struct> <member> <name> </name> </member> </struct> > < ' ' " & Sending data Data sent Receiving response Waiting for response Response received Handle closing Status %d range error: array index too large type error: expected an array type error --- 4c7906e2f2a82fdfad74b47c90350771 /mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1673/$R6SODDB/svchost.exe c78655bc80301d76ed4fef1c1ea40a7d /mnt/nfury/Windows/System32/svchost.exe
stat '/mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1673/$R6SODDB/svchost.exe' 2>/dev/nullstrings '/mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1673/$R6SODDB/svchost.exe' 2>/dev/null | head -80md5sum '/mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1673/$R6SODDB/svchost.exe' '/mnt/nfury/Windows/System32/svchost.exe' 2>/dev/nullFile: /mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1673/$R6SODDB/svchost.exe Size: 102400 Blocks: 200 IO Block: 4096 regular file Device: 7,11 Inode: 92255 Links: 1 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 17:13:56.460811600 +0000 Modify: 2008-04-14 00:12:36.000000000 +0000 Change: 2012-04-06 18:42:04.171044200 +0000 Birth: - --- !This program cannot be run in DOS mode. Rich .text `.data .reloc bad allocation %s\%s a.exe pause System\CurrentControlSet\Services\netman\domain false true vector<T> too long bad cast ios_base::eofbit set ios_base::failbit set ios_base::badbit set raB3G%p Client threw unexpected error. Client threw error: sending: received: connection.execute() failed in t.f Error calling listen Error calling bind 127.0.0.1 recv_loop exiting! recv_loop recv_data() returned false recv() returned <= 0 exiting run loop on behalf of exitEvent run exiting! send_data() returned false Received id: Error calling accept Received connection! Accepting connections... home http://192.168.1.5/ads/ <value> </value> <boolean> </boolean> <double> </double> <int> </int> <i4> </i4> <string> </string> <dateTime.iso8601> </dateTime.iso8601> <base64> </base64> <array> <data> </data> </array> <struct> <member> <name> </name> </member> </struct> > < ' ' " & Sending data Data sent Receiving response Waiting for response Response received Handle closing Status %d range error: array index too large type error: expected an array type error --- 4c7906e2f2a82fdfad74b47c90350771 /mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1673/$R6SODDB/svchost.exe c78655bc80301d76ed4fef1c1ea40a7d /mnt/nfury/Windows/System32/svchost.exe
Volatility 3 Framework 2.27.0 PID Process Start VPN End VPN Tag Protection CommitCharge PrivateMemory File output Notes Hexdump Disasm 812 LogonUI.exe 0x2c00000 0x2c00fff VadS PAGE_EXECUTE_READWRITE 1 1 Disabled N/A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 c0 02 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x2c00000: add byte ptr [rax], al 0x2c00002: add byte ptr [rax], al 0x2c00004: add byte ptr [rax], al 0x2c00006: add byte ptr [rax], al 0x2c00008: add byte ptr [rax], al 0x2c0000a: add byte ptr [rax], al 0x2c0000c: add byte ptr [rax], al 0x2c0000e: add byte ptr [rax], al 0x2c00010: add byte ptr [rax], al 0x2c00012: add byte ptr [rax], al 0x2c00014: add byte ptr [rax], al 0x2c00016: add byte ptr [rax], al 0x2c00018: add byte ptr [rax], al 0x2c0001a: add byte ptr [rax], al 0x2c0001c: add byte ptr [rax], al 0x2c0001e: add byte ptr [rax], al 0x2c00020: add byte ptr [rax], al 0x2c00022: rol byte ptr [rdx], 0 0x2c00025: add byte ptr [rax], al 0x2c00027: add byte ptr [rax], al 0x2c00029: add byte ptr [rax], al 0x2c0002b: add byte ptr [rax], al 0x2c0002d: add byte ptr [rax], al 0x2c0002f: add byte ptr [rax], al 0x2c00031: add byte ptr [rax], al 0x2c00033: add byte ptr [rax], al 0x2c00035: add byte ptr [rax], al 0x2c00037: add byte ptr [rax], al 0x2c00039: add byte ptr [rax], al 0x2c0003b: add byte ptr [rax], al 0x2c0003d: add byte ptr [rax], al 1472 FrameworkServi 0x3aa0000 0x3aa0fff VadS PAGE_EXECUTE_READWRITE 1 1 Disabled N/A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 ................ 10 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 ................ 20 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 ............... 0x3aa0000: add byte ptr [eax], al 0x3aa0002: add byte ptr [eax], al 0x3aa0004: add byte ptr [eax], al 0x3aa0006: add byt
/opt/volatility3/bin/vol -q -f /home/sansforensics/cases/nfury/win7-64-nfury-memory/win7-64-nfury-memory-raw.001 windows.malfind 2>/dev/null | head -80/opt/volatility3/bin/vol -q -f /home/sansforensics/cases/nfury/win7-64-nfury-memory/win7-64-nfury-memory-raw.001 windows.pstree 2>/dev/null/opt/volatility3/bin/vol -q -f /home/sansforensics/cases/nfury/win7-64-nfury-memory/win7-64-nfury-memory-raw.001 windows.malfind 2>/dev/null | grep -E "^[0-9]+" | awk '{print $1, $2, $6, $7}' | sort -uVolatility 3 Framework 2.27.0 PID Process Start VPN End VPN Tag Protection CommitCharge PrivateMemory File output Notes Hexdump Disasm 812 LogonUI.exe 0x2c00000 0x2c00fff VadS PAGE_EXECUTE_READWRITE 1 1 Disabled N/A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 c0 02 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x2c00000: add byte ptr [rax], al 0x2c00002: add byte ptr [rax], al 0x2c00004: add byte ptr [rax], al 0x2c00006: add byte ptr [rax], al 0x2c00008: add byte ptr [rax], al 0x2c0000a: add byte ptr [rax], al 0x2c0000c: add byte ptr [rax], al 0x2c0000e: add byte ptr [rax], al 0x2c00010: add byte ptr [rax], al 0x2c00012: add byte ptr [rax], al 0x2c00014: add byte ptr [rax], al 0x2c00016: add byte ptr [rax], al 0x2c00018: add byte ptr [rax], al 0x2c0001a: add byte ptr [rax], al 0x2c0001c: add byte ptr [rax], al 0x2c0001e: add byte ptr [rax], al 0x2c00020: add byte ptr [rax], al 0x2c00022: rol byte ptr [rdx], 0 0x2c00025: add byte ptr [rax], al 0x2c00027: add byte ptr [rax], al 0x2c00029: add byte ptr [rax], al 0x2c0002b: add byte ptr [rax], al 0x2c0002d: add byte ptr [rax], al 0x2c0002f: add byte ptr [rax], al 0x2c00031: add byte ptr [rax], al 0x2c00033: add byte ptr [rax], al 0x2c00035: add byte ptr [rax], al 0x2c00037: add byte ptr [rax], al 0x2c00039: add byte ptr [rax], al 0x2c0003b: add byte ptr [rax], al 0x2c0003d: add byte ptr [rax], al 1472 FrameworkServi 0x3aa0000 0x3aa0fff VadS PAGE_EXECUTE_READWRITE 1 1 Disabled N/A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 ................ 10 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 ................ 20 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 ............... 0x3aa0000: add byte ptr [eax], al 0x3aa0002: add byte ptr [eax], al 0x3aa0004: add byte ptr [eax], al 0x3aa0006: add byte ptr [eax], al 0x3aa0008: add byte ptr [eax], al 0x3aa000a: add byte ptr [eax], al 0x3aa000c: add byte ptr [eax], al 0x3aa000e: add byte ptr [eax], al 0x3aa0010: add byte ptr [eax], al 0x3aa0012: stosb byte ptr es:[edi], al 0x3aa0013: add eax, dword ptr [eax] 0x3aa0015: add byte ptr [eax], al 0x3aa0017: add byte ptr [eax], al 0x3aa0019: add byte ptr [eax], al 0x3aa001b: add byte ptr [eax], al 0x3aa001d: add byte ptr [eax], al 0x3aa001f: add byte ptr [eax], dl 0x3aa0021: add byte ptr [edx + 3], ch 0x3aa0027: add byte ptr [eax], al 0x3aa0029: add byte ptr [eax], al 0x3aa002b: add byte ptr [eax], al 0x3aa002d: add byte ptr [eax], al 0x3aa002f: add byte ptr [eax], ah 0x3aa0031: add byte ptr [edx + 3], ch 0x3aa0037: add byte ptr [eax], al 0x3aa0039: add byte ptr [eax], al 0x3aa003b: add byte ptr [eax], al 0x3aa003d: add byte ptr [eax], al 1568 mfevtps.exe 0x710000 0x78ffff VadS PAGE_EXECUTE_READWRITE 2 1 Disabled N/A 00 00 00 00 00 00 00 00 41 b3 5a 88 c2 b4 00 01 ........A.Z..... ee ff ee ff 00 00 00 00 28 01 71 00 00 00 00 00 ........(.q..... 28 01 71 00 00 00 00 00 00 00 71 00 00 00 00 00 (.q.......q..... 00 00 71 00 00 00 00 00 80 00 00 00 00 00 00 00 ..q............. 0x710000: add byte ptr [rax], al 0x710002: add byte ptr [rax], al --- Volatility 3 Framework 2.27.0 PID PPID ImageFileName Offset(V) Threads Handles SessionId Wow64 CreateTime ExitTime Audit Cmd Path 4 0 System 0xfa8018dd3040 95 455 N/A False 2012-04-06 19:11:29.000000 UTC N/A - - - * 264 4 smss.exe 0xfa801938d940 2 29 N/A False 2012-04-06 19:11:30.000000 UTC N/A \Device\HarddiskVolume1\Windows\System32\smss.exe \SystemRoot\System32\smss.exe \SystemRoot\System32\smss.exe 388 380 csrss.exe 0xfa801aa8b060 10 569 0 False 2012-04-06 19:11:48.000000 UTC N/A \Device\HarddiskVolume1\Windows\System32\csrss.exe %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=wi
838297,838297,2012-03-13 23:27:24.0187879,4672,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,2508,WKS-WIN764BITB.shieldbase.local,0,,Administrative logon,SHIELDBASE\rsydow (S-1-5-21-2036804247-3058324640-2116585241-1114),,"PrivilegeList: SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege, SeSystemEnvironmentPrivilege, SeLoadDriverPrivilege, SeImpersonatePrivilege",LogonId: 0x3B4976F,,,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-14-05-34-20-035.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-5-21-2036804247-3058324640-2116585241-1114""},{""@Name"":""SubjectUserName"",""#text"":""rsydow""},{""@Name"":""SubjectDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""SubjectLogonId"",""#text"":""0x3B4976F""},{""@Name"":""PrivilegeList"",""#text"":""SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege, SeSystemEnvironmentPrivilege, SeLoadDriverPrivilege, SeImpersonatePrivilege""}]}}"
838300,838300,2012-03-13 23:27:49.5812879,4672,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,2508,WKS-WIN764BITB.shieldbase.local,0,,Administrative logon,SHIELDBASE\rsydow (S-1-5-21-2036804247-3058324640-2116585241-1114),,"PrivilegeList: SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege, SeSystemEnvironmentPrivilege, SeLoadDriverPrivilege, SeImpersonatePrivilege",LogonId: 0x3B4A9E2,,,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-14-05-34-20-035.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-5-21-2036804247-3058324640-2116585241-1114""},{""@Name"":""SubjectUserName"",""#text"":""rsydow""},{""@Name"":""SubjectDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""SubjectLogonId"",""#text"":""0x3B4A9E2""},{""@Name"":""PrivilegeList"",""#text"":""SeSecurityPrivilege, SeBackupPr
grep -iE 'sedebugprivilege|seimpersonateprivilege' /tmp/evtx_out/evtx_arch2.csv | head -30grep -iE '4672' /tmp/evtx_out/evtx_arch2.csv | grep -iE 'rsydow|nromanoff|tdungan|vibranium' | head -20grep -iE '4672' /tmp/evtx_out/evtx_arch2.csv | grep -iE 'sedebugprivilege|seimpersonateprivilege' | awk -F',' '{print $3, $13}' | sort -u | head -30838297,838297,2012-03-13 23:27:24.0187879,4672,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,2508,WKS-WIN764BITB.shieldbase.local,0,,Administrative logon,SHIELDBASE\rsydow (S-1-5-21-2036804247-3058324640-2116585241-1114),,"PrivilegeList: SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege, SeSystemEnvironmentPrivilege, SeLoadDriverPrivilege, SeImpersonatePrivilege",LogonId: 0x3B4976F,,,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-14-05-34-20-035.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-5-21-2036804247-3058324640-2116585241-1114""},{""@Name"":""SubjectUserName"",""#text"":""rsydow""},{""@Name"":""SubjectDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""SubjectLogonId"",""#text"":""0x3B4976F""},{""@Name"":""PrivilegeList"",""#text"":""SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege, SeSystemEnvironmentPrivilege, SeLoadDriverPrivilege, SeImpersonatePrivilege""}]}}"
838300,838300,2012-03-13 23:27:49.5812879,4672,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,2508,WKS-WIN764BITB.shieldbase.local,0,,Administrative logon,SHIELDBASE\rsydow (S-1-5-21-2036804247-3058324640-2116585241-1114),,"PrivilegeList: SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege, SeSystemEnvironmentPrivilege, SeLoadDriverPrivilege, SeImpersonatePrivilege",LogonId: 0x3B4A9E2,,,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-14-05-34-20-035.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-5-21-2036804247-3058324640-2116585241-1114""},{""@Name"":""SubjectUserName"",""#text"":""rsydow""},{""@Name"":""SubjectDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""SubjectLogonId"",""#text"":""0x3B4A9E2""},{""@Name"":""PrivilegeList"",""#text"":""SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege, SeSystemEnvironmentPrivilege, SeLoadDriverPrivilege, SeImpersonatePrivilege""}]}}"
838302,838302,2012-03-13 23:27:52.3625379,4672,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,2508,WKS-WIN764BITB.shieldbase.local,0,,Administrative logon,SHIELDBASE\rsydow (S-1-5-21-2036804247-3058324640-2116585241-1114),,"PrivilegeList: SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege, SeSystemEnvironmentPrivilege, SeLoadDriverPrivilege, SeImpersonatePrivilege",LogonId: 0x3B4AA16,,,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-14-05-34-20-035.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-5-21-2036804247-3058324640-2116585241-1114""},{""@Name"":""SubjectUserName"",""#text"":""rsydow""},{""@Name"":""SubjectDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""SubjectLogonId"",""#text"":""0x3B4AA16""},{""@Name"":""PrivilegeList"",""#text"":""SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege, SeSystemEnvironmentPrivilege, SeLoadDriverPrivilege, SeImpersonatePrivilege""}]}}"
838305,838305,2012-03-13 23:29:25.0812879,4672,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,4344,WKS-WIN764BITB.shieldbase.local,0,,Administrative logon,SHIELDBASE\rsydow (S-1-5-21-2036804247-3058324640-2116585241-1114),,"PrivilegeList: SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege, SeSystemEnvironmentPrivilege, SeLoadDriverPrivilege, SeImpersonatePrivilege",LogonId: 0x3B4B5E0,,,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-14-05-34-20-035.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-5-21-2036804247-3058324640-2116585241-1114""},{""@Name"":""SubjectUserName"",""#text"":""rsydow""},{""@Name"":""SubjectDomainName
37503 6152 -rwxrwxrwx 1 root root 6297428 Apr 6 2012 /mnt/nfury/Users/Public/Temp/system4.rar
93069 1 -rwxrwxrwx 2 root root 64 Apr 6 2012 /mnt/nfury/Users/Public/Temp/\316\246\303\247\302\254\316\246\342\224\220\342\226\221
---
/mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1105/$II3DF3L.zip
/mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1105/$RI3DF3L.zip
/mnt/nfury/Users/nfury/Documents/StarFury.zip
/mnt/nfury/Users/Public/Temp/system4.rar
---
00000000: 5261 7221 1a07 00ce 9973 8000 0d00 0000 Rar!.....s......
00000010: 0000 0000 bc97 4ec2 156a 47e7 632e 9ebb ......N..jG.c...
00000020: 6531 167b cfd5 b126 e29c 8470 cbd6 a7f6 e1.{...&...p....
00000030: a2ed 596d a1cf 7a9f 45ca 9176 ae1f 5a74 ..Ym..z.E..v..Zt
find /mnt/nfury/Users/Public/Temp -type f -ls 2>/dev/nullfind /mnt/nfury -iname '*.rar' -o -iname '*.7z' -o -iname '*.zip' 2>/dev/null | grep -v -i 'Program Files\|Windows\|AppData\|installer\|setup' | head -30xxd /mnt/nfury/Users/Public/Temp/system4.rar 2>/dev/null | head -437503 6152 -rwxrwxrwx 1 root root 6297428 Apr 6 2012 /mnt/nfury/Users/Public/Temp/system4.rar
93069 1 -rwxrwxrwx 2 root root 64 Apr 6 2012 /mnt/nfury/Users/Public/Temp/\316\246\303\247\302\254\316\246\342\224\220\342\226\221
---
/mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1105/$II3DF3L.zip
/mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1105/$RI3DF3L.zip
/mnt/nfury/Users/nfury/Documents/StarFury.zip
/mnt/nfury/Users/Public/Temp/system4.rar
---
00000000: 5261 7221 1a07 00ce 9973 8000 0d00 0000 Rar!.....s......
00000010: 0000 0000 bc97 4ec2 156a 47e7 632e 9ebb ......N..jG.c...
00000020: 6531 167b cfd5 b126 e29c 8470 cbd6 a7f6 e1.{...&...p....
00000030: a2ed 596d a1cf 7a9f 45ca 9176 ae1f 5a74 ..Ym..z.E..v..Zt
--- /mnt/nfury/Windows/System32/config/SYSTEM ---
find /mnt/nfury -iname 'psexesvc.exe' -o -iname 'psexec.exe' -o -iname 'psexec64.exe' 2>/dev/nullgrep -ril 'psexesvc\|psexec' /mnt/nfury/Windows/System32/config/ 2>/dev/null | head -20find /mnt/nfury -iname '*.evtx' | xargs grep -lil 'psexesvc' 2>/dev/null | head -10--- /mnt/nfury/Windows/System32/config/SYSTEM ---
find /mnt/nfury -type f -iname "NTUSER.DAT" 2>/dev/nullfind /mnt/nfury -type f \( -iname "SOFTWARE" -o -iname "SYSTEM" \) -path "*/config/*" 2>/dev/nullfor hive in /mnt/nfury/Users/Administrator/NTUSER.DAT /mnt/nfury/Users/nfury/NTUSER.DAT /mnt/nfury/Users/rsydow/NTUSER.DAT /mnt/nfury/Users/SRL-Helpdesk/NTUSER.DAT /mnt/nfury/Users/tdungan/NTUSER.DAT /mnt/nfury/Users/vibranium/NTUSER.DAT; do
echo "=== $hive ===";
strings "$hive" 2>/dev/null | grep -i -A2 -B2 "currentversion\\\\run";
done/mnt/nfury/Users/Administrator/NTUSER.DAT /mnt/nfury/Users/Default/NTUSER.DAT /mnt/nfury/Users/nfury/NTUSER.DAT /mnt/nfury/Users/Public/NTUSER.DAT /mnt/nfury/Users/rsydow/NTUSER.DAT /mnt/nfury/Users/SRL-Helpdesk/NTUSER.DAT /mnt/nfury/Users/tdungan/NTUSER.DAT /mnt/nfury/Users/vibranium/NTUSER.DAT /mnt/nfury/Windows/ServiceProfiles/LocalService/NTUSER.DAT /mnt/nfury/Windows/ServiceProfiles/NetworkService/NTUSER.DAT /mnt/nfury/Windows/System32/config/systemprofile/ntuser.dat --- /mnt/nfury/Windows/System32/config/RegBack/SOFTWARE /mnt/nfury/Windows/System32/config/RegBack/SYSTEM /mnt/nfury/Windows/System32/config/SOFTWARE /mnt/nfury/Windows/System32/config/SYSTEM --- ERROR: Command blocked — binary 'for' not in forensic allowlist
strings /mnt/nfury/Windows/System32/config/SOFTWARE 2>/dev/null | grep -i -A2 -B2 "currentversion\\\\run" | head -80run_volatilityfind /mnt/nfury/Users -iname "NTUSER.DAT" 2>/dev/null | while read h; do echo "=== $h ==="; strings "$h" 2>/dev/null | grep -i -A3 "currentversion.run" | head -30; done---
{
"memory_image": "/home/sansforensics/cases/nfury/win7-64-nfury-memory/win7-64-nfury-memory-raw.001",
"plugin": "windows.registry.printkey",
"row_count": 12,
"output": "Volatility 3 Framework 2.27.0\nLast Write Time\tHive Offset\tType\tKey\tName\tData\tVolatile\n-\t0xf8a00000e010\tKey\t[NONAME]\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xf8a000024010\tKey\t\\REGISTRY\\MACHINE\\SYSTEM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xf8a00005c010\tKey\t\\REGISTRY\\MACHINE\\HARDWARE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xf8a000812010\tKey\t\\SystemRoot\\System32\\Config\\SAM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xf8a000816010\tKey\t\\SystemRoot\\System32\\Config\\SECURITY\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xf8a00086d410\tKey\t\\SystemRoot\\System32\\Config\\SOFTWARE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xf8a0017b3010\tKey\t\\??\\C:\\System Volume Information\\Syscache.hve\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n-\t0xf8a003e78010\tKey\t\\Device\\HarddiskVolume1\\Boot\\BCD\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\t-\t-\t-\n2009-07-14 04:45:47.000000 UTC\t0xf8a003f73010\tREG_EXPAND_SZ\t\\??\\C:\\Windows\\ServiceProfiles\\NetworkService\\NTUSER.DAT\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\tSidebar\t%ProgramFiles%\\Windows Sidebar\\Sidebar.exe /autoRun\tFalse\n2009-07-14 04:45:48.000000 UTC\t0xf8a007ef7010\tREG_EXPAND_SZ\t\\??\\C:\\Windows\\ServiceProfiles\\LocalService\\NTUSER.DAT\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\tSidebar\t%ProgramFiles%\\Windows Sidebar\\Sidebar.exe /autoRun\tFalse",
"truncated": false
}
---
ERROR: Command blocked — binary 'while' not in forensic allowlist
run_volatilityfind /mnt/nfury -iname "*.dll" -newer /mnt/nfury/Windows/System32/kernel32.dll 2>/dev/null | grep -v "WinSxS\|Temp\|Prefetch" | head -40find /mnt/nfury -iname "*.dll" -newer /mnt/nfury/Windows/System32/kernel32.dll 2>/dev/null | grep -Ev "WinSxS|installer|Prefetch" | head -40{
"memory_image": "/home/sansforensics/cases/nfury/win7-64-nfury-memory/win7-64-nfury-memory-raw.001",
"plugin": "windows.malfind",
"row_count": 127,
"output": "Volatility 3 Framework 2.27.0\nPID\tProcess\tStart VPN\tEnd VPN\tTag\tProtection\tCommitCharge\tPrivateMemory\tFile output\tNotes\tHexdump\tDisasm\n812\tLogonUI.exe\t0x2c00000\t0x2c00fff\tVadS\tPAGE_EXECUTE_READWRITE\t1\t1\tDisabled\tN/A\t\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 c0 02 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\t\n0x2c00000:\tadd\tbyte ptr [rax], al\n0x2c00002:\tadd\tbyte ptr [rax], al\n0x2c00004:\tadd\tbyte ptr [rax], al\n0x2c00006:\tadd\tbyte ptr [rax], al\n0x2c00008:\tadd\tbyte ptr [rax], al\n0x2c0000a:\tadd\tbyte ptr [rax], al\n0x2c0000c:\tadd\tbyte ptr [rax], al\n0x2c0000e:\tadd\tbyte ptr [rax], al\n0x2c00010:\tadd\tbyte ptr [rax], al\n0x2c00012:\tadd\tbyte ptr [rax], al\n0x2c00014:\tadd\tbyte ptr [rax], al\n0x2c00016:\tadd\tbyte ptr [rax], al\n0x2c00018:\tadd\tbyte ptr [rax], al\n0x2c0001a:\tadd\tbyte ptr [rax], al\n0x2c0001c:\tadd\tbyte ptr [rax], al\n0x2c0001e:\tadd\tbyte ptr [rax], al\n0x2c00020:\tadd\tbyte ptr [rax], al\n0x2c00022:\trol\tbyte ptr [rdx], 0\n0x2c00025:\tadd\tbyte ptr [rax], al\n0x2c00027:\tadd\tbyte ptr [rax], al\n0x2c00029:\tadd\tbyte ptr [rax], al\n0x2c0002b:\tadd\tbyte ptr [rax], al\n0x2c0002d:\tadd\tbyte ptr [rax], al\n0x2c0002f:\tadd\tbyte ptr [rax], al\n0x2c00031:\tadd\tbyte ptr [rax], al\n0x2c00033:\tadd\tbyte ptr [rax], al\n0x2c00035:\tadd\tbyte ptr [rax], al\n0x2c00037:\tadd\tbyte ptr [rax], al\n0x2c00039:\tadd\tbyte ptr [rax], al\n0x2c0003b:\tadd\tbyte ptr [rax], al\n0x2c0003d:\tadd\tbyte ptr [rax], al\n1472\tFrameworkServi\t0x3aa0000\t0x3aa0fff\tVadS\tPAGE_EXECUTE_READWRITE\t1\t1\tDisabled\tN/A\t\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 ................\n10 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 ................\n20 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 ...............\t\n0x3aa0000:\tadd\tbyte ptr [eax], al\n0x3aa0002:\tadd\tbyte ptr [eax], al\n0x3aa0004:\tadd\tbyte ptr [eax], al\n0x3aa0006:\tadd\tbyte ptr [eax], al\n0x3aa0008:\tadd\tbyte ptr [eax], al\n0x3aa000a:\tadd\tbyte ptr [eax], al\n0x3aa000c:\tadd\tbyte ptr [eax], al\n0x3aa000e:\tadd\tbyte ptr [eax], al\n0x3aa0010:\tadd\tbyte ptr [eax], al\n0x3aa0012:\tstosb\tbyte ptr es:[edi], al\n0x3aa0013:\tadd\teax, dword ptr [eax]\n0x3aa0015:\tadd\tbyte ptr [eax], al\n0x3aa0017:\tadd\tbyte ptr [eax], al\n0x3aa0019:\tadd\tbyte ptr [eax], al\n0x3aa001b:\tadd\tbyte ptr [eax], al\n0x3aa001d:\tadd\tbyte ptr [eax], al\n0x3aa001f:\tadd\tbyte ptr [eax], dl",
"truncated": true
}
---
ERROR: Command blocked — binary 'temp\\' not in forensic allowlist
---
ERROR: Command blocked — binary 'installer' not in forensic allowlist
| Step | Time | Host | User | Technique | Evidence |
|---|---|---|---|---|---|
| 1 | 2012-03-13 23:27:24 | WKS-WIN764BITB | SHIELDBASE\rsydow | Network logon (Type 3) from 10.3.58.4 with full admin privileges | EventID 4672+4624, Archive-Security-2012-03-13-22-30-32-081.evtx, Record #838297–838298 |
| 2 | 2012-03-13 23:29:25 | WKS-WIN764BITB | SHIELDBASE\rsydow | Created local account SRL-Helpdesk (S-1-5-21-228041085-1601810819-2769380060-1001) | EventID 4720+4722+4728, Archive-Security-2012-03-14-05-34-20-035.evtx, Records #838307–838309 |
| 3 | 2012-03-15 22:11:55 | WKS-WIN764BITB | S-1-5-21-...-1114 (rsydow) | Installed kernel driver BCSWAP (C:\Windows\system32\drivers\BCSWAP.sys) and BCWipe anti-forensics service | EventID 7045, System.evtx, Records #12331–12332 |
| 4 | 2012-03-15 22:11:56 | WKS-WIN764BITB | S-1-5-21-...-1114 (rsydow) | Installed kernel driver fsh (C:\Windows\system32\drivers\fsh.sys, boot-start) | EventID 7045, System.evtx, Record #12333 |
| 5 | 2012-04-04 17:06:37 | WKS-WIN764BITB | — | spinlock.exe (PyInstaller-packed Python tool) written to System32 | stat mtime: 2012-04-04 17:06:37; /mnt/nfury/Windows/System32/spinlock.exe, MD5 6bff2aebb8852fc2658b9768d2166ece, size 2,271,885 bytes |
| 6 | 2012-04-05 16:54:26 | WKS-WIN764BITB | — | spinlock.exe accessed/executed (atime updated) | stat atime: 2012-04-05 16:54:26; embedded strings: python25.dll, MSVCR71.dll, PyRun_SimpleString |
| 7 | 2012-04-05 17:03:51 | WKS-WIN764BITB | S-1-5-21-...-1673 (vibranium SID) | PsExec service installed (%SystemRoot%\PSEXESVC.EXE, demand-start, LocalSystem) | EventID 7045, System.evtx, Record #13304 |
| 8 | 2012-04-05 17:07:15 | WKS-WIN764BITB | S-1-5-21-...-1673 (vibranium SID) | PsExec service installed a second time | EventID 7045, System.evtx, Record #13307 |
| 9 | 2012-04-05 17:13:56 | WKS-WIN764BITB | — | Fake svchost.exe (C2 client, httppump) placed in Recycle Bin staging area | stat atime: 2012-04-05 17:13:56; /mnt/nfury/$Recycle.Bin/S-1-5-21-...-1673/$R6SODDB/svchost.exe, MD5 4c7906e2f2a82fdfad74b47c90350771, size 102,400 bytes; strings: "a.exe", "http://192.168.1.5/ads/", "System\CurrentControlSet\Services\netman\domain", PDB path d:\work\hg\httppump\winclient\… |
| 10 | 2012-04-05 18:27:50 | WKS-WIN764BITB | — | a.exe (shellcode injector) written to C:\Windows\Temp | stat mtime: 2012-04-05 18:27:50; /mnt/nfury/Windows/Temp/a.exe, MD5 c4b0458c04abdaa773348c2668212b45, size 9,216 bytes; strings: PDB c:\code\httppump\inner\…\i.pdb, WriteProcessMemory, VirtualAlloc, LoadLibraryA, CreateThread |
| 11 | 2012-04-05 18:46:42 | WKS-WIN764BITB | — | $RD5HSV3.exe (PyInstaller/Python27 shell tool "shell.exe") written to Recycle Bin | stat mtime: 2012-04-05 18:46:42; /mnt/nfury/$Recycle.Bin/S-1-5-21-...-1673/$RD5HSV3.exe, MD5 4117561b12601d66b0cee41343f1492f, size 3,943,584; strings: python27.dll, pywintypes27.dll, shell.exe.manifest, httplib, cmd, ftplib |
| 12 | 2012-04-05 18:48:41 | WKS-WIN764BITB | — | $RD5HSV3.exe (shell.exe) executed — PyInstaller extraction directory created | stat atime: 2012-04-05 18:48:41; _MEI65402 temp dir created with shell.exe.manifest (mtime 2012-04-05 18:55:08) at /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/ |
| 13 | 2012-04-05 18:55:08 | WKS-WIN764BITB | vibranium | shell.exe extracted and ran under vibranium profile | /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/shell.exe.manifest, mtime 2012-04-05 18:55:08; python27.dll, pywintypes27.dll, win32api.pyd, _socket.pyd, _ssl.pyd all present in extraction dir |
| 14 | 2012-04-06 13:43:21 | WKS-WIN764BITB | vibranium | a.exe (shellcode injector, identical copy) written to vibranium's Temp | stat atime: 2012-04-06 13:43:21, mtime: 2012-04-06 18:09:50; /mnt/nfury/Users/vibranium/AppData/Local/Temp/a.exe, MD5 c4b0458c04abdaa773348c2668212b45 (identical to Windows\Temp copy) |
| 15 | 2012-04-06 13:52:56 | WKS-WIN764BITB | vibranium | system4.rar archive (6.3 MB) downloaded/placed in Public\Temp — likely tool/payload bundle | stat atime: 2012-04-06 13:52:56, mtime: 2012-04-06 13:53:09; /mnt/nfury/Users/Public/Temp/system4.rar, MD5 06a889b10ea9465e46554d6460f29bf2 |
| 16 | 2012-04-06 14:52:14 | WKS-WIN764BITB | — | $RZI9VH9.exe (PyInstaller/Python25 "hythonized2.exe") placed in Recycle Bin | stat atime: 2012-04-06 14 |
File: /mnt/nfury/Users/vibranium/AppData/Local/Temp/a.exe Size: 9216 Blocks: 24 IO Block: 4096 regular file Device: 7,11 Inode: 80517 Links: 1 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-06 13:43:21.871688500 +0000 Modify: 2012-04-06 18:09:50.010674400 +0000 Change: 2012-04-06 18:09:50.010674400 +0000 Birth: -
File: /mnt/nfury/Windows/Temp/a.exe Size: 9216 Blocks: 24 IO Block: 4096 regular file Device: 7,11 Inode: 92257 Links: 1 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 17:47:00.523311600 +0000 Modify: 2012-04-05 18:27:50.132686600 +0000 Change: 2012-04-05 18:27:50.132686600 +0000 Birth: -
File: /mnt/nfury/Windows/System32/spinlock.exe Size: 2271885 Blocks: 4440 IO Block: 4096 regular file Device: 7,11 Inode: 540 Links: 1 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 16:54:26.085811600 +0000 Modify: 2012-04-04 17:06:37.834267100 +0000 Change: 2012-04-05 16:54:26.507686600 +0000 Birth: -
File: /mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1673/$R6SODDB/svchost.exe Size: 102400 Blocks: 200 IO Block: 4096 regular file Device: 7,11 Inode: 92255 Links: 1 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 17:13:56.460811600 +0000 Modify: 2008-04-14 00:12:36.000000000 +0000 Change: 2012-04-06 18:42:04.171044200 +0000 Birth: -
{
"file": "/mnt/nfury/Users/vibranium/AppData/Local/Temp/a.exe",
"algorithm": "md5",
"hash": "c4b0458c04abdaa773348c2668212b45"
}
{
"file": "/mnt/nfury/Windows/Temp/a.exe",
"algorithm": "md5",
"hash": "c4b0458c04abdaa773348c2668212b45"
}
{
"file": "/mnt/nfury/Windows/System32/spinlock.exe",
"algorithm": "md5",
"hash": "6bff2aebb8852fc2658b9768d2166ece"
}
{
"file": "/mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1673/$R6SODDB/svchost.exe",
"algorithm": "md5",
"hash": "4c7906e2f2a82fdfad74b47c90350771"
}
!This program cannot be run in DOS mode.
RichO
.text
`.data
.reloc
SetUnhandledExceptionFilter
kernel32.dll
('8PW
700PP
```hhh
xppwpp
RSDS
c:\code\httppump\inner\objchk_wxp_x86\i386\i.pdb
Y_^[
URPQQh(
L$,3
UVWS
[_^]
SVWj
_^[]
8csm
8csm
_^[]
Y__^[
t?!E
v N+D$
UQPXY]Y[
WriteProcessMemory
GetCurrentProcess
GetProcAddress
LoadLibraryA
ExitThread
VirtualAlloc
ExitProcess
CloseHandle
WaitForSingleObject
CreateThread
SetErrorMode
SetUnhandledExceptionFilter
KERNEL32.dll
__getmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
msvcrt.dll
?terminate@@YAXXZ
_controlfp
InterlockedExchange
Sleep
InterlockedCompareExchange
RtlUnwind
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
_oB&3! vK#Nr
V\3%
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
!This program cannot be run in DOS mode. Rich .text `.data .reloc bad allocation %s\%s a.exe pause System\CurrentControlSet\Services\netman\domain false true vector<T> too long bad cast ios_base::eofbit set ios_base::failbit set ios_base::badbit set raB3G%p Client threw unexpected error. Client threw error: sending: received: connection.execute() failed in t.f Error calling listen Error calling bind 127.0.0.1 recv_loop exiting! recv_loop recv_data() returned false recv() returned <= 0 exiting run loop on behalf of exitEvent run exiting! send_data() returned false Received id: Error calling accept Received connection! Accepting connections... home http://192.168.1.5/ads/ <value> </value> <boolean> </boolean> <double> </double> <int> </int> <i4> </i4> <string> </string> <dateTime.iso8601> </dateTime.iso8601> <base64> </base64> <array> <data> </data> </array> <struct> <member> <name> </name> </member> </struct> > < ' ' " & Sending data Data sent Receiving response Waiting for response Response received Handle closing Status %d range error: array index too large type error: expected an array type error
!This program cannot be run in DOS mode. RichV .text `.rdata @.data .rsrc D$0P |$t+ L$ Q T$4RSSSj D$0P _^][ |$(+ h,RA T$(P t^h,RA hXRA =(PA hDRA Y_^[ htRA hhRA |$$Wh _^[3 <Mua D$4j =(PA h`[A hP[A h$[A hTZA h@ZA hpYA hDYA h,YA hlXA h`XA h8XA h(XA htWA hHWA h0WA hxVA hlVA hDVA h4VA h|UA hLUA h8UA h|TA hdTA h4TA h TA hpSA h`SA h8SA h(SA h<\A 5@PA h<\A hP\A _^][ t%hp\A hD]A h,]A zu V hP\A L$DR L$ QPh T$ RPh`]A (SRh j Vh V Rh u0UV T$0+ hp^A |$8O |$8+ hp^A D$<P
!This program cannot be run in DOS mode. _MEIPASS2= _MEIPASS2 Cannot GetProcAddress for PyRun_SimpleString PyRun_SimpleString %spython%02d.dll Error detected starting Python VM. runtime error An application has made an attempt to load the C runtime library incorrectly. This application has requested the Runtime to terminate it in an unusual way. Microsoft Visual C++ Runtime Library Runtime Error! .cmd .exe GetUserObjectInformationA USER32.DLL USER32.dll COMCTL32.dll GetStartupInfoW KERNEL32.dll WS2_32.dll GetStartupInfoA 1C2a qC2<~OZ d(C2; C2[m8 a?3c2G UserDict( C2Do lkc2 DaC2 C2|G Q,c2 X)/c2T }c2/C S|6wC2 c2LP 2*c2. A"c2 C2hlQ J|^gljWRUNgu fTPTPT bkernel32.dll bpython25.dll bMSVCR71.dll bspinlock.exe.manifest
!This program cannot be run in DOS mode. a.exe System\CurrentControlSet\Services\netman\domain connection.execute() failed in t.f exiting run loop on behalf of exitEvent run exiting! http://192.168.1.5/ads/ Talking HTTPS to an HTTP server? The URI must begin with "https://" || "http://". http:// https:// Talking HTTP to a HTTPS server? Low level (HTTP) error: %d %s Could not query HTTP result status HttpSendRequest HttpOpenRequest HTTP/1.0 Invalid parameter passed to C runtime function. d:\work\hg\httppump\winclient\objfre_wxp_x86\i386\winclient.pdb ADVAPI32.dll KERNEL32.dll __setusermatherr msvcrt.dll WS2_32.dll HttpQueryInfoA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA WININET.dll .?AVruntime_error@std@@
File: /mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1673/$RD5HSV3.exe Size: 3943584 Blocks: 7704 IO Block: 4096 regular file Device: 7,11 Inode: 1511 Links: 1 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-05 18:48:41.382686600 +0000 Modify: 2012-04-05 18:46:42.000000000 +0000 Change: 2012-04-06 18:43:07.461923000 +0000 Birth: - File: /mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1673/$RZI9VH9.exe Size: 2990574 Blocks: 5848 IO Block: 4096 regular file Device: 7,11 Inode: 511 Links: 1 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-06 14:52:14.438827400 +0000 Modify: 2012-04-06 14:55:38.054054400 +0000 Change: 2012-04-06 18:43:07.559462400 +0000 Birth: -
{
"file": "/mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1673/$RD5HSV3.exe",
"algorithm": "md5",
"hash": "4117561b12601d66b0cee41343f1492f"
}
{
"file": "/mnt/nfury/$Recycle.Bin/S-1-5-21-2036804247-3058324640-2116585241-1673/$RZI9VH9.exe",
"algorithm": "md5",
"hash": "ccabfd203130aa555b0fa21344055a44"
}
!This program cannot be run in DOS mode. _MEIPASS2= _MEIPASS2 Cannot GetProcAddress for PyRun_SimpleString PyRun_SimpleString Error loading Python DLL: %s (error code %d) %spython%02d.dll Error detected starting Python VM. PYTHONHOME= PYTHONPATH= runtime error An application has made an attempt to load the C runtime library incorrectly. This application has requested the Runtime to terminate it in an unusual way. Microsoft Visual C++ Runtime Library Runtime Error! .cmd .exe GetUserObjectInformationA USER32.DLL USER32.dll COMCTL32.dll KERNEL32.dll WS2_32.dll httplib( cmd( ftplib( UserDict( unittest.runner( pdb( getpass( 30pdb 2CMdY0` sshell bmsvcr90.dll bmsvcp90.dll bmsvcm90.dll bpython27.dll bpywintypes27.dll bshell.exe.manifest
!This program cannot be run in DOS mode. _MEIPASS2= _MEIPASS2 Cannot GetProcAddress for PyRun_SimpleString PyRun_SimpleString Error loading Python DLL: %s (error code %d) %spython%02d.dll Error detected starting Python VM. PYTHONHOME= PYTHONPATH= runtime error An application has made an attempt to load the C runtime library incorrectly. This application has requested the Runtime to terminate it in an unusual way. Microsoft Visual C++ Runtime Library Runtime Error! .cmd .exe GetUserObjectInformationA USER32.DLL USER32.dll COMCTL32.dll KERNEL32.dll WS2_32.dll Ftp2 httplib( cmd( ftplib( UserDict( pdb( getpass( PDbi+ pDbh J|^gljWRUNgu fTPTPT bkernel32.dll bpython25.dll bMSVCR71.dll bhythonized2.exe.manifest
{
"evtx_dir": "/mnt/nfury/Windows/System32/winevt/Logs",
"format": "csv",
"output_path": "/home/sansforensics/adversa/reports/winevt-hayabusa.csv",
"line_count": 0,
"output": "",
"truncated": false
}
{
"evtx_dir": "/mnt/nfury/Windows/System32/winevt/Logs",
"format": "summary",
"output_path": null,
"line_count": 0,
"output": "",
"truncated": false
}
ERROR: Command blocked — redirection: write target '/dev/null;' resolves outside reports/ (resolved: /dev/null;)
/mnt/nfury/Windows/Prefetch
EvtxECmd version 1.5.2.0 Author: Eric Zimmerman (saericzimmerman@gmail.com) https://github.com/EricZimmerman/evtx Command line: -f /mnt/nfury/Windows/System32/winevt/Logs/Security.evtx --csv /tmp/evtx_out --csvf evtx_security.csv CSV output will be saved to /tmp/evtx_out/evtx_security.csv Maps loaded: 453 Processing /mnt/nfury/Windows/System32/winevt/Logs/Security.evtx... Chunk count: 1, Iterating records... Record #: 980829 (timestamp: 2012-04-07 11:12:31.3867240): Warning! Time just went backwards! Last seen time before change: 2012-04-07 11:12:35.6055280 Error processing record #980945: Root element is missing. Event log details Flags: IsDirty Chunk count: 1 Stored/Calculated CRC: 25876434/25876434 Earliest timestamp: 2012-04-07 11:12:31.3867240 Latest timestamp: 2012-04-08 04:00:09.0126808 Total event log records found: 117 Records included: 116 Errors: 1 Events dropped: 0 Errors Record #21: Error: Root element is missing. Metrics (including dropped events) Event ID Count 1105 1 4624 17 4634 15 4648 5 4672 15 4674 30 4719 24 4985 9 6144 1 Processed 1 file in 1.0496 seconds Files with errors /mnt/nfury/Windows/System32/winevt/Logs/Security.evtx error count: 1
980829,980829,2012-04-07 11:12:31.3867240,4624,LogAlways,Microsoft-Windows-Security-Auditing,Security,552,2824,WKS-WIN764BITB.shieldbase.local,0,,Successful logon,-\-," (-)",Target: SHIELDBASE\WKS-WIN764BITB$,LogonType 3,LogonId: 0x452F18,AuthenticationPackageName: Kerberos,LogonProcessName: Kerberos,,-,False,/mnt/nfury/Windows/System32/winevt/Logs/Security.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-0-0""},{""@Name"":""SubjectUserName"",""#text"":""-""},{""@Name"":""SubjectDomainName"",""#text"":""-""},{""@Name"":""SubjectLogonId"",""#text"":""0x0""},{""@Name"":""TargetUserSid"",""#text"":""S-1-5-18""},{""@Name"":""TargetUserName"",""#text"":""WKS-WIN764BITB$""},{""@Name"":""TargetDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""TargetLogonId"",""#text"":""0x452F18""},{""@Name"":""LogonType"",""#text"":""3""},{""@Name"":""LogonProcessName"",""#text"":""Kerberos""},{""@Name"":""AuthenticationPackageName"",""#text"":""Kerberos""},{""@Name"":""WorkstationName""},{""@Name"":""LogonGuid"",""#text"":""e32cd009-6392-7254-c784-5628a0f9e8e8""},{""@Name"":""TransmittedServices"",""#text"":""-""},{""@Name"":""LmPackageName"",""#text"":""-""},{""@Name"":""KeyLength"",""#text"":""0""},{""@Name"":""ProcessId"",""#text"":""0x0""},{""@Name"":""ProcessName"",""#text"":""-""},{""@Name"":""IpAddress"",""#text"":""-""},{""@Name"":""IpPort"",""#text"":""-""}]}}"
980831,980831,2012-04-07 11:12:32.3242360,4648,LogAlways,Microsoft-Windows-Security-Auditing,Security,552,2824,WKS-WIN764BITB.shieldbase.local,0,,A logon was attempted using explicit credentials,SHIELDBASE\WKS-WIN764BITB$,-:-,Target: SHIELDBASE.LOCAL\WKS-WIN764BITB$,TargetServerName: wks-win764bitb$,PID: 0x658,TargetInfo: wks-win764bitb$,,,C:\Windows\System32\taskhost.exe,False,/mnt/nfury/Windows/System32/winevt/Logs/Security.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-5-18""},{""@Name"":""SubjectUserName"",""#text"":""WKS-WIN764BITB$""},{""@Name"":""SubjectDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""SubjectLogonId"",""#text"":""0x3E7""},{""@Name"":""LogonGuid"",""#text"":""00000000-0000-0000-0000-000000000000""},{""@Name"":""TargetUserName"",""#text"":""WKS-WIN764BITB$""},{""@Name"":""TargetDomainName"",""#text"":""SHIELDBASE.LOCAL""},{""@Name"":""TargetLogonGuid"",""#text"":""7671d877-63c4-3549-fd1e-39b9bfeeb3db""},{""@Name"":""TargetServerName"",""#text"":""wks-win764bitb$""},{""@Name"":""TargetInfo"",""#text"":""wks-win764bitb$""},{""@Name"":""ProcessId"",""#text"":""0x658""},{""@Name"":""ProcessName"",""#text"":""C:\\Windows\\System32\\taskhost.exe""},{""@Name"":""IpAddress"",""#text"":""-""},{""@Name"":""IpPort"",""#text"":""-""}]}}"
980833,980833,2012-04-07 11:12:32.3242360,4624,LogAlways,Microsoft-Windows-Security-Auditing,Security,552,2824,WKS-WIN764BITB.shieldbase.local,0,,Successful logon,-\-," (-)",Target: SHIELDBASE\WKS-WIN764BITB$,LogonType 3,LogonId: 0x453310,AuthenticationPackageName
EvtxECmd version 1.5.2.0 Author: Eric Zimmerman (saericzimmerman@gmail.com) https://github.com/EricZimmerman/evtx Command line: -f /mnt/nfury/Windows/System32/winevt/Logs/System.evtx --csv /tmp/evtx_out --csvf evtx_system.csv CSV output will be saved to /tmp/evtx_out/evtx_system.csv Maps loaded: 453 Processing /mnt/nfury/Windows/System32/winevt/Logs/System.evtx... Chunk count: 9, Iterating records... Record #: 12050 (timestamp: 2012-03-14 04:17:38.2763402): Warning! Time just went backwards! Last seen time before change: 2012-03-14 04:17:43.3545627 Record # 12135 (Event Record Id: 12135): In map for event 1074, Property /Event/EventData/Data[@Name="param7"] not found! Replacing with empty string Record # 12135 (Event Record Id: 12135): In map for event 1074, Property /Event/EventData/Data[@Name="param1"] not found! Replacing with empty string Record # 12135 (Event Record Id: 12135): In map for event 1074, Property /Event/EventData/Data[@Name="param2"] not found! Replacing with empty string Record # 12135 (Event Record Id: 12135): In map for event 1074, Property /Event/EventData/Data[@Name="param3"] not found! Replacing with empty string Record # 12135 (Event Record Id: 12135): In map for event 1074, Property /Event/EventData/Data[@Name="param5"] not found! Replacing with empty string Record # 12135 (Event Record Id: 12135): In map for event 1074, Property /Event/EventData/Data[@Name="param4"] not found! Replacing with empty string Record #: 12155 (timestamp: 2012-03-15 07:07:59.2936728): Warning! Time just went backwards! Last seen time before change: 2012-03-15 07:12:59.0000000 Record # 12169 (Event Record Id: 12169): In map for event 1, Property /Event/EventData/Data[@Name="Reason"] not found! Replacing with empty string Record # 12178 (Event Record Id: 12178): In map for event 13, Property /Event/EventData/Data[@Name="BootMode"] not found! Replacing with empty string Record # 12228 (Event Record Id: 12228): In map for event 1, Property /Event/EventData/Data[@Name="Reason"] not found! Replacing with empty string Record # 12345 (Event Record Id: 12345): In map for event 1074, Property /Event/EventData/Data[@Name="param7"] not found! Replacing with empty string Record # 12345 (Event Record Id: 12345): In map for event 1074, Property /Event/EventData/Data[@Name="param1"] not found! Replacing with empty string Record # 12345 (Event Record Id: 12345): In map for event 1074, Property /Event/EventData/Data[@Name="param2"] not found! Replacing with empty string Record # 12345 (Event Record Id: 12345): In map for event 1074, Property /Event/EventData/Data[@Name="param3"] not found! Replacing with empty string Record # 12345 (Event Record Id: 12345): In map for event 1074, Property /Event/EventData/Data[@Name="param5"] not found! Replacing with empty string Record # 12345 (Event Record Id: 12345): In map for event 1074, Property /Event/EventData/Data[@Name="param4"] not found! Replacing with empty string Record #: 12358 (timestamp: 2012-03-15 22:22:
12050,12050,2012-03-14 04:17:38.2763402,7036,Info,Service Control Manager,System,548,1340,WKS-WIN764BITB.shieldbase.local,0,,Service started or stopped,,,Name: Windows Modules Installer | Windows Modules Installer,Status: stopped,,,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/System.evtx,"Audit success, classic",0,"{""EventData"":{""Data"":[{""@Name"":""param1"",""#text"":""Windows Modules Installer""},{""@Name"":""param2"",""#text"":""stopped""}],""Binary"":""54-00-72-00-75-00-73-00-74-00-65-00-64-00-49-00-6E-00-73-00-74-00-61-00-6C-00-6C-00-65-00-72-00-2F-00-31-00-00-00""}}"
12051,12051,2012-03-14 04:33:11.9573375,7036,Info,Service Control Manager,System,548,5448,WKS-WIN764BITB.shieldbase.local,0,,Service started or stopped,,,Name: WinHTTP Web Proxy Auto-Discovery Service | WinHTTP Web Proxy Auto-Discovery Service,Status: stopped,,,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/System.evtx,"Audit success, classic",0,"{""EventData"":{""Data"":[{""@Name"":""param1"",""#text"":""WinHTTP Web Proxy Auto-Discovery Service""},{""@Name"":""param2"",""#text"":""stopped""}],""Binary"":""57-00-69-00-6E-00-48-00-74-00-74-00-70-00-41-00-75-00-74-00-6F-00-50-00-72-00-6F-00-78-00-79-00-53-00-76-00-63-00-2F-00-31-00-00-00""}}"
12052,12052,2012-03-14 05:40:46.5534667,7036,Info,Service Control Manager,System,548,5764,WKS-WIN764BITB.shieldbase.local,0,,Service started or stopped,,,Name: WinHTTP Web Proxy Auto-Discovery Service | WinHTTP Web Proxy Auto-Discovery Service,Status: running,,,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/System.evtx,"Audit success, classic",0,"{""EventData"":{""Data"":[{""@Name"":""param1"",""#text"":""WinHTTP Web Proxy Auto-Discovery Service""},{""@Name"":""param2"",""#text"":""running""}],""Binary"":""57-00-69-00-6E-00-48-00-74-00-74-00-70-00-41-00-75-00-74-00-6F-00-50-00-72-00-6F-00-78-00-79-00-53-00-76-00-63-00-2F-00-34-00-00-00""}}"
12053,12053,2012-03-14 05:57:16.5598027,7036,Info,Service Control Manager,System,548,3680,WKS-WIN764BITB.shieldbase.local,0,,Service started or stopped,,,Name: WinHTTP Web Proxy Auto-Discovery Service | WinHTTP Web Proxy Auto-Discovery Service,Status: stopped,,,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/System.evtx,"Audit success, classic",0,"{""EventData"":{""Data"":[{""@Name"":""param1"",""#text"":""WinHTTP Web Proxy Auto-Discovery Service""},{""@Name"":""param2"",""#text"":""stopped""}],""Binary"":""57-00-69-00-6E-00-48-00-74-00-74-00-70-00-41-00-75-00-74-00-6F-00-50-00-72-00-6F-00-78-00-79-00-53-00-76-00-63-00-2F-00-31-00-00-00""}}"
12054,12054,2012-03-14 06:41:13.9036388,7036,Info,Service Control Manager,System,548,920,WKS-WIN764BITB.shieldbase.local,0,,Service started or stopped,,,Name: Disk Defragmenter | Disk Defragmenter,Status: running,,,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/System.evtx,"Audit success, classic",0,"{""EventData"":{""Data"":[{""@Name"":""param1"",""#text"":""Disk Defragmenter""},{""@Name"":""param2"",""#text"":""running""}],""Binary"":""64-00-65-00-66-
EvtxECmd version 1.5.2.0 Author: Eric Zimmerman (saericzimmerman@gmail.com) https://github.com/EricZimmerman/evtx Command line: -f /mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-13-22-30-32-081.evtx --csv /tmp/evtx_out --csvf evtx_arch1.csv CSV output will be saved to /tmp/evtx_out/evtx_arch1.csv Maps loaded: 453 Processing /mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-13-22-30-32-081.evtx... Chunk count: 320, Iterating records... Record #: 810843 (timestamp: 2012-03-03 05:35:47.5156184): Warning! Time just went backwards! Last seen time before change: 2012-03-13 22:30:31.9875379 Event log details Flags: None Chunk count: 320 Stored/Calculated CRC: D14F527A/D14F527A Earliest timestamp: 2012-03-03 05:35:47.5156184 Latest timestamp: 2012-03-13 22:30:31.9875379 Total event log records found: 27,434 Records included: 27,434 Errors: 0 Events dropped: 0 Metrics (including dropped events) Event ID Count 1104 1 4611 18 4624 2,291 4625 9 4634 2,236 4647 3 4648 77 4663 19,881 4672 265 4673 65 4674 489 4719 360 4778 4 4779 4 4800 3 4801 3 4904 4 4905 4 4985 1,672 5056 1 5058 1 5061 1 6144 15 6281 23 8222 4 Processed 1 file in 7.9906 seconds
824962,824962,2012-03-05 14:10:47.0555334,4648,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,3516,WKS-WIN764BITB.shieldbase.local,51,,A logon was attempted using explicit credentials,SHIELDBASE\WKS-WIN764BITB$,127.0.0.1:0,Target: SHIELDBASE\rsydow,TargetServerName: localhost,PID: 0x1E4,TargetInfo: localhost,,,C:\Windows\System32\winlogon.exe,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-13-22-30-32-081.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-5-18""},{""@Name"":""SubjectUserName"",""#text"":""WKS-WIN764BITB$""},{""@Name"":""SubjectDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""SubjectLogonId"",""#text"":""0x3E7""},{""@Name"":""LogonGuid"",""#text"":""00000000-0000-0000-0000-000000000000""},{""@Name"":""TargetUserName"",""#text"":""rsydow""},{""@Name"":""TargetDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""TargetLogonGuid"",""#text"":""2761f779-2d2e-0449-b86f-9a8fd982b827""},{""@Name"":""TargetServerName"",""#text"":""localhost""},{""@Name"":""TargetInfo"",""#text"":""localhost""},{""@Name"":""ProcessId"",""#text"":""0x1E4""},{""@Name"":""ProcessName"",""#text"":""C:\\Windows\\System32\\winlogon.exe""},{""@Name"":""IpAddress"",""#text"":""127.0.0.1""},{""@Name"":""IpPort"",""#text"":""0""}]}}"
824963,824963,2012-03-05 14:10:47.0555334,4624,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,3516,WKS-WIN764BITB.shieldbase.local,51,,Successful logon,SHIELDBASE\WKS-WIN764BITB$,WKS-WIN764BITB (127.0.0.1),Target: SHIELDBASE\rsydow,LogonType 2,LogonId: 0xD120F6,AuthenticationPackageName: Negotiate,"LogonProcessName: User32 ",,C:\Windows\System32\winlogon.exe,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-13-22-30-32-081.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-5-18""},{""@Name"":""SubjectUserName"",""#text"":""WKS-WIN764BITB$""},{""@Name"":""SubjectDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""SubjectLogonId"",""#text"":""0x3E7""},{""@Name"":""TargetUserSid"",""#text"":""S-1-5-21-2036804247-3058324640-2116585241-1114""},{""@Name"":""TargetUserName"",""#text"":""rsydow""},{""@Name"":""TargetDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""TargetLogonId"",""#text"":""0xD120F6""},{""@Name"":""LogonType"",""#text"":""2""},{""@Name"":""LogonProcessName"",""#text"":""User32 ""},{""@Name"":""AuthenticationPackageName"",""#text"":""Negotiate""},{""@Name"":""WorkstationName"",""#text"":""WKS-WIN764BITB""},{""@Name"":""LogonGuid"",""#text"":""2761f779-2d2e-0449-b86f-9a8fd982b827""},{""@Name"":""TransmittedServices"",""#text"":""-""},{""@Name"":""LmPackageName"",""#text"":""-""},{""@Name"":""KeyLength"",""#text"":""0""},{""@Name"":""ProcessId"",""#text"":""0x1E4""},{""@Name"":""ProcessName"",""#text"":""C:\\Windows\\System32\\winlogon.exe""},{""@Name"":""IpAddress"",""#text"":""127.0.0.1""},{""@Name"":""IpPort"",""#text"":""0""}]}}"
824964,824964,2012-03-05 14:10:47.0555334
12331,12331,2012-03-15 22:11:55.2166658,7045,Info,Service Control Manager,System,548,3292,WKS-WIN764BITB.shieldbase.local,1,S-1-5-21-2036804247-3058324640-2116585241-1114,A new service was installed in the system,,,Name: BCSWAP,StartType: disabled,"Account: ",,,,C:\Windows\system32\drivers\BCSWAP.sys,False,/mnt/nfury/Windows/System32/winevt/Logs/System.evtx,"Audit success, classic",0,"{""EventData"":{""Data"":[{""@Name"":""ServiceName"",""#text"":""BCSWAP""},{""@Name"":""ImagePath"",""#text"":""C:\\Windows\\system32\\drivers\\BCSWAP.sys""},{""@Name"":""ServiceType"",""#text"":""kernel mode driver""},{""@Name"":""StartType"",""#text"":""disabled""},{""@Name"":""AccountName""}]}}"
12332,12332,2012-03-15 22:11:55.8191663,7045,Info,Service Control Manager,System,548,3292,WKS-WIN764BITB.shieldbase.local,1,S-1-5-21-2036804247-3058324640-2116585241-1114,A new service was installed in the system,,,Name: BCWipe service,StartType: auto start,Account: LocalSystem,,,,C:\Program Files (x86)\Jetico\BCWipe\BCWipeSvc.exe,False,/mnt/nfury/Windows/System32/winevt/Logs/System.evtx,"Audit success, classic",0,"{""EventData"":{""Data"":[{""@Name"":""ServiceName"",""#text"":""BCWipe service""},{""@Name"":""ImagePath"",""#text"":""C:\\Program Files (x86)\\Jetico\\BCWipe\\BCWipeSvc.exe""},{""@Name"":""ServiceType"",""#text"":""user mode service""},{""@Name"":""StartType"",""#text"":""auto start""},{""@Name"":""AccountName"",""#text"":""LocalSystem""}]}}"
12333,12333,2012-03-15 22:11:56.0535263,7045,Info,Service Control Manager,System,548,2052,WKS-WIN764BITB.shieldbase.local,1,S-1-5-21-2036804247-3058324640-2116585241-1114,A new service was installed in the system,,,Name: fsh,StartType: boot start,"Account: ",,,,C:\Windows\system32\drivers\fsh.sys,False,/mnt/nfury/Windows/System32/winevt/Logs/System.evtx,"Audit success, classic",0,"{""EventData"":{""Data"":[{""@Name"":""ServiceName"",""#text"":""fsh""},{""@Name"":""ImagePath"",""#text"":""C:\\Windows\\system32\\drivers\\fsh.sys""},{""@Name"":""ServiceType"",""#text"":""kernel mode driver""},{""@Name"":""StartType"",""#text"":""boot start""},{""@Name"":""AccountName""}]}}"
12892,12892,2012-03-20 18:59:53.1272192,7045,Info,Service Control Manager,System,508,4596,WKS-WIN764BITB.shieldbase.local,4,S-1-5-21-2036804247-3058324640-2116585241-1114,A new service was installed in the system,,,Name: FResponse Service,StartType: demand start,Account: LocalSystem,,,,f-response-ent.exe,False,/mnt/nfury/Windows/System32/winevt/Logs/System.evtx,"Audit success, classic",0,"{""EventData"":{""Data"":[{""@Name"":""ServiceName"",""#text"":""FResponse Service""},{""@Name"":""ImagePath"",""#text"":""f-response-ent.exe""},{""@Name"":""ServiceType"",""#text"":""user mode service""},{""@Name"":""StartType"",""#text"":""demand start""},{""@Name"":""AccountName"",""#text"":""LocalSystem""}]}}"
12894,12894,2012-03-20 18:59:55.4554336,7045,Info,Service Control Manager,System,508,4596,WKS-WIN764BITB.shieldbase.local,4,S-1-5-18,A new service was install
12331,12331,2012-03-15 22:11:55.2166658,7045,Info,Service Control Manager,System,548,3292,WKS-WIN764BITB.shieldbase.local,1,S-1-5-21-2036804247-3058324640-2116585241-1114,A new service was installed in the system,,,Name: BCSWAP,StartType: disabled,"Account: ",,,,C:\Windows\system32\drivers\BCSWAP.sys,False,/mnt/nfury/Windows/System32/winevt/Logs/System.evtx,"Audit success, classic",0,"{""EventData"":{""Data"":[{""@Name"":""ServiceName"",""#text"":""BCSWAP""},{""@Name"":""ImagePath"",""#text"":""C:\\Windows\\system32\\drivers\\BCSWAP.sys""},{""@Name"":""ServiceType"",""#text"":""kernel mode driver""},{""@Name"":""StartType"",""#text"":""disabled""},{""@Name"":""AccountName""}]}}"
12332,12332,2012-03-15 22:11:55.8191663,7045,Info,Service Control Manager,System,548,3292,WKS-WIN764BITB.shieldbase.local,1,S-1-5-21-2036804247-3058324640-2116585241-1114,A new service was installed in the system,,,Name: BCWipe service,StartType: auto start,Account: LocalSystem,,,,C:\Program Files (x86)\Jetico\BCWipe\BCWipeSvc.exe,False,/mnt/nfury/Windows/System32/winevt/Logs/System.evtx,"Audit success, classic",0,"{""EventData"":{""Data"":[{""@Name"":""ServiceName"",""#text"":""BCWipe service""},{""@Name"":""ImagePath"",""#text"":""C:\\Program Files (x86)\\Jetico\\BCWipe\\BCWipeSvc.exe""},{""@Name"":""ServiceType"",""#text"":""user mode service""},{""@Name"":""StartType"",""#text"":""auto start""},{""@Name"":""AccountName"",""#text"":""LocalSystem""}]}}"
12333,12333,2012-03-15 22:11:56.0535263,7045,Info,Service Control Manager,System,548,2052,WKS-WIN764BITB.shieldbase.local,1,S-1-5-21-2036804247-3058324640-2116585241-1114,A new service was installed in the system,,,Name: fsh,StartType: boot start,"Account: ",,,,C:\Windows\system32\drivers\fsh.sys,False,/mnt/nfury/Windows/System32/winevt/Logs/System.evtx,"Audit success, classic",0,"{""EventData"":{""Data"":[{""@Name"":""ServiceName"",""#text"":""fsh""},{""@Name"":""ImagePath"",""#text"":""C:\\Windows\\system32\\drivers\\fsh.sys""},{""@Name"":""ServiceType"",""#text"":""kernel mode driver""},{""@Name"":""StartType"",""#text"":""boot start""},{""@Name"":""AccountName""}]}}"
12894,12894,2012-03-20 18:59:55.4554336,7045,Info,Service Control Manager,System,508,4596,WKS-WIN764BITB.shieldbase.local,4,S-1-5-18,A new service was installed in the system,,,Name: Mnemosyne,StartType: demand start,"Account: ",,,,C:\Windows\system32\Mnemosyne_x64.sys,False,/mnt/nfury/Windows/System32/winevt/Logs/System.evtx,"Audit success, classic",0,"{""EventData"":{""Data"":[{""@Name"":""ServiceName"",""#text"":""Mnemosyne""},{""@Name"":""ImagePath"",""#text"":""C:\\Windows\\system32\\Mnemosyne_x64.sys""},{""@Name"":""ServiceType"",""#text"":""kernel mode driver""},{""@Name"":""StartType"",""#text"":""demand start""},{""@Name"":""AccountName""}]}}"
13304,13304,2012-04-05 17:03:51.7576866,7045,Info,Service Control Manager,System,508,5156,WKS-WIN764BITB.shieldbase.local,7,S-1-5-21-2036804247-3058324640-2116585241-1673,A new service was installed in the
EvtxECmd version 1.5.2.0 Author: Eric Zimmerman (saericzimmerman@gmail.com) https://github.com/EricZimmerman/evtx Command line: -f /mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-14-05-34-20-035.evtx --csv /tmp/evtx_out --csvf evtx_arch2.csv CSV output will be saved to /tmp/evtx_out/evtx_arch2.csv Maps loaded: 453 Processing /mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-14-05-34-20-035.evtx... Chunk count: 64, Iterating records... Record #: 838278 (timestamp: 2012-03-13 22:30:30.5344129): Warning! Time just went backwards! Last seen time before change: 2012-03-13 22:30:38.8000379 Event log details Flags: None Chunk count: 64 Stored/Calculated CRC: C8743DD4/C8743DD4 Earliest timestamp: 2012-03-13 22:30:30.5344129 Latest timestamp: 2012-03-14 05:34:20.0353680 Total event log records found: 5,478 Records included: 5,478 Errors: 0 Events dropped: 0 Metrics (including dropped events) Event ID Count 1104 1 1105 1 4624 84 4634 82 4648 2 4663 5,242 4672 13 4674 15 4719 24 4720 1 4722 1 4724 1 4728 1 4732 2 4738 3 4985 4 6144 1 Processed 1 file in 2.8965 seconds
838307,838307,2012-03-13 23:29:25.0812879,4728,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,4344,WKS-WIN764BITB.shieldbase.local,0,,A member was added to a security-enabled global group,SHIELDBASE\rsydow (S-1-5-21-2036804247-3058324640-2116585241-1114),,Target: WKS-WIN764BITB\None (S-1-5-21-228041085-1601810819-2769380060-513),Member: -,MemberSid: S-1-5-21-228041085-1601810819-2769380060-1001,SubjectLogonId: 0x3B4B5E0,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-14-05-34-20-035.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""MemberName"",""#text"":""-""},{""@Name"":""MemberSid"",""#text"":""S-1-5-21-228041085-1601810819-2769380060-1001""},{""@Name"":""TargetUserName"",""#text"":""None""},{""@Name"":""TargetDomainName"",""#text"":""WKS-WIN764BITB""},{""@Name"":""TargetSid"",""#text"":""S-1-5-21-228041085-1601810819-2769380060-513""},{""@Name"":""SubjectUserSid"",""#text"":""S-1-5-21-2036804247-3058324640-2116585241-1114""},{""@Name"":""SubjectUserName"",""#text"":""rsydow""},{""@Name"":""SubjectDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""SubjectLogonId"",""#text"":""0x3B4B5E0""},{""@Name"":""PrivilegeList"",""#text"":""-""}]}}"
838308,838308,2012-03-13 23:29:25.0812879,4720,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,4344,WKS-WIN764BITB.shieldbase.local,0,,A new account was created,SHIELDBASE\rsydow (S-1-5-21-2036804247-3058324640-2116585241-1114),,Target: WKS-WIN764BITB\SRL-Helpdesk (S-1-5-21-228041085-1601810819-2769380060-1001),,,,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-14-05-34-20-035.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""TargetUserName"",""#text"":""SRL-Helpdesk""},{""@Name"":""TargetDomainName"",""#text"":""WKS-WIN764BITB""},{""@Name"":""TargetSid"",""#text"":""S-1-5-21-228041085-1601810819-2769380060-1001""},{""@Name"":""SubjectUserSid"",""#text"":""S-1-5-21-2036804247-3058324640-2116585241-1114""},{""@Name"":""SubjectUserName"",""#text"":""rsydow""},{""@Name"":""SubjectDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""SubjectLogonId"",""#text"":""0x3B4B5E0""},{""@Name"":""PrivilegeList"",""#text"":""-""},{""@Name"":""SamAccountName"",""#text"":""SRL-Helpdesk""},{""@Name"":""DisplayName"",""#text"":""%%1793""},{""@Name"":""UserPrincipalName"",""#text"":""-""},{""@Name"":""HomeDirectory"",""#text"":""%%1793""},{""@Name"":""HomePath"",""#text"":""%%1793""},{""@Name"":""ScriptPath"",""#text"":""%%1793""},{""@Name"":""ProfilePath"",""#text"":""%%1793""},{""@Name"":""UserWorkstations"",""#text"":""%%1793""},{""@Name"":""PasswordLastSet"",""#text"":""%%1794""},{""@Name"":""AccountExpires"",""#text"":""%%1794""},{""@Name"":""PrimaryGroupId"",""#text"":""513""},{""@Name"":""AllowedToDelegateTo"",""#text"":""-""},{""@Name"":""OldUacValue"",""#text"":""0x0""},{""@Name"":""NewUacValue"",""#text"":""0x15""},{""@Name"":""UserAccountControl"",""#text"":"", %%2080, %%2082, %%2084""},{""@Name"":""UserParameters"",""#text
838297,838297,2012-03-13 23:27:24.0187879,4672,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,2508,WKS-WIN764BITB.shieldbase.local,0,,Administrative logon,SHIELDBASE\rsydow (S-1-5-21-2036804247-3058324640-2116585241-1114),,"PrivilegeList: SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege, SeSystemEnvironmentPrivilege, SeLoadDriverPrivilege, SeImpersonatePrivilege",LogonId: 0x3B4976F,,,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-14-05-34-20-035.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-5-21-2036804247-3058324640-2116585241-1114""},{""@Name"":""SubjectUserName"",""#text"":""rsydow""},{""@Name"":""SubjectDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""SubjectLogonId"",""#text"":""0x3B4976F""},{""@Name"":""PrivilegeList"",""#text"":""SeSecurityPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege, SeSystemEnvironmentPrivilege, SeLoadDriverPrivilege, SeImpersonatePrivilege""}]}}"
838298,838298,2012-03-13 23:27:24.0187879,4624,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,2508,WKS-WIN764BITB.shieldbase.local,0,,Successful logon,-\-," (10.3.58.4)",Target: SHIELDBASE\rsydow,LogonType 3,LogonId: 0x3B4976F,AuthenticationPackageName: Kerberos,LogonProcessName: Kerberos,,-,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-14-05-34-20-035.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-0-0""},{""@Name"":""SubjectUserName"",""#text"":""-""},{""@Name"":""SubjectDomainName"",""#text"":""-""},{""@Name"":""SubjectLogonId"",""#text"":""0x0""},{""@Name"":""TargetUserSid"",""#text"":""S-1-5-21-2036804247-3058324640-2116585241-1114""},{""@Name"":""TargetUserName"",""#text"":""rsydow""},{""@Name"":""TargetDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""TargetLogonId"",""#text"":""0x3B4976F""},{""@Name"":""LogonType"",""#text"":""3""},{""@Name"":""LogonProcessName"",""#text"":""Kerberos""},{""@Name"":""AuthenticationPackageName"",""#text"":""Kerberos""},{""@Name"":""WorkstationName""},{""@Name"":""LogonGuid"",""#text"":""a9f88c9a-88a1-b9e2-1627-4812e534df0f""},{""@Name"":""TransmittedServices"",""#text"":""-""},{""@Name"":""LmPackageName"",""#text"":""-""},{""@Name"":""KeyLength"",""#text"":""0""},{""@Name"":""ProcessId"",""#text"":""0x0""},{""@Name"":""ProcessName"",""#text"":""-""},{""@Name"":""IpAddress"",""#text"":""10.3.58.4""},{""@Name"":""IpPort"",""#text"":""61021""}]}}"
838299,838299,2012-03-13 23:27:34.8000379,4634,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,2508,WKS-WIN764BITB.shieldbase.local,0,,An account was logged off,,,Target: SHIELDBASE\rsydow,LogonType 3,LogonId: 0x3B4976F,,,,,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-14-05-34-20-035.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""TargetUserSid"",""#text"":""S-1-5-21-2036804247
----------------------------------------
EvtxECmd version 1.5.2.0 Author: Eric Zimmerman (saericzimmerman@gmail.com) https://github.com/EricZimmerman/evtx Command line: -f /mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-16-05-06-31-812.evtx --csv /tmp/evtx_out --csvf evtx_arch3.csv CSV output will be saved to /tmp/evtx_out/evtx_arch3.csv Maps loaded: 453 Processing /mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-16-05-06-31-812.evtx... Chunk count: 64, Iterating records... Record #: 843756 (timestamp: 2012-03-14 05:34:18.8478604): Warning! Time just went backwards! Last seen time before change: 2012-03-14 05:34:22.0353808 Record # 846628 (Event Record Id: 846628): In map for event 1100, Property /Event/UserData[@Name="ServiceShutdown"] not found! Replacing with empty string Record # 846929 (Event Record Id: 846929): In map for event 1100, Property /Event/UserData[@Name="ServiceShutdown"] not found! Replacing with empty string Record #: 846981 (timestamp: 2012-03-15 22:24:43.9005000): Warning! Time just went backwards! Last seen time before change: 2012-03-15 22:24:52.1250000 Record # 847058 (Event Record Id: 847058): In map for event 1100, Property /Event/UserData[@Name="ServiceShutdown"] not found! Replacing with empty string Record #: 847106 (timestamp: 2012-03-15 22:35:55.0840000): Warning! Time just went backwards! Last seen time before change: 2012-03-15 22:36:00.6250000 Event log details Flags: None Chunk count: 64 Stored/Calculated CRC: 7BF59872/7BF59872 Earliest timestamp: 2012-03-14 05:34:18.8478604 Latest timestamp: 2012-03-16 05:06:31.8123059 Total event log records found: 5,772 Records included: 5,772 Errors: 0 Events dropped: 0 Metrics (including dropped events) Event ID Count 1100 3 1104 1 1105 1 4608 3 4610 3 4611 37 4614 3 4616 6 4622 27 4624 685 4625 8 4634 609 4647 3 4648 17 4660 13 4663 3,866 4664 16 4672 116 4673 55 4674 102 4719 48 4776 1 4779 1 4902 3 4904 3 4905 3 4907 14 4985 100 5024 3 5033 3 5056 3 5058 3 5061 3 6144 2 6281 5 8222 3 Processed 1 file in 2.8704 seconds
844375,844375,2012-03-14 05:35:39.2546250,4663,LogAlways,Microsoft-Windows-Security-Auditing,Security,4,44,WKS-WIN764BITB.shieldbase.local,8,,Attempt was made to access an object,SHIELDBASE\WKS-WIN764BITB$,,ObjectServer: Security,ObjectType: File,ObjectName: C:\Windows\winsxs\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_6.1.7600.16506_none_6fec9927c5239918\secproc_ssp.dll,"AccessList: Unknown code (%%4424, )",,,C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-16-05-06-31-812.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-5-18""},{""@Name"":""SubjectUserName"",""#text"":""WKS-WIN764BITB$""},{""@Name"":""SubjectDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""SubjectLogonId"",""#text"":""0x3E7""},{""@Name"":""ObjectServer"",""#text"":""Security""},{""@Name"":""ObjectType"",""#text"":""File""},{""@Name"":""ObjectName"",""#text"":""C:\\Windows\\winsxs\\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_6.1.7600.16506_none_6fec9927c5239918\\secproc_ssp.dll""},{""@Name"":""HandleId"",""#text"":""0x8E8""},{""@Name"":""AccessList"",""#text"":""%%4424, ""},{""@Name"":""AccessMask"",""#text"":""0x100""},{""@Name"":""ProcessId"",""#text"":""0x6AC""},{""@Name"":""ProcessName"",""#text"":""C:\\Program Files\\Common Files\\McAfee\\SystemCore\\mcshield.exe""}]}}"
844376,844376,2012-03-14 05:35:39.2546250,4663,LogAlways,Microsoft-Windows-Security-Auditing,Security,4,44,WKS-WIN764BITB.shieldbase.local,8,,Attempt was made to access an object,SHIELDBASE\WKS-WIN764BITB$,,ObjectServer: Security,ObjectType: File,ObjectName: C:\Windows\winsxs\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_6.1.7600.16506_none_6fec9927c5239918\secproc_ssp.dll,"AccessList: Unknown code (%%4424, )",,,C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-16-05-06-31-812.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-5-18""},{""@Name"":""SubjectUserName"",""#text"":""WKS-WIN764BITB$""},{""@Name"":""SubjectDomainName"",""#text"":""SHIELDBASE""},{""@Name"":""SubjectLogonId"",""#text"":""0x3E7""},{""@Name"":""ObjectServer"",""#text"":""Security""},{""@Name"":""ObjectType"",""#text"":""File""},{""@Name"":""ObjectName"",""#text"":""C:\\Windows\\winsxs\\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_6.1.7600.16506_none_6fec9927c5239918\\secproc_ssp.dll""},{""@Name"":""HandleId"",""#text"":""0x8E8""},{""@Name"":""AccessList"",""#text"":""%%4424, ""},{""@Name"":""AccessMask"",""#text"":""0x100""},{""@Name"":""ProcessId"",""#text"":""0x6AC""},{""@Name"":""ProcessName"",""#text"":""C:\\Program Files\\Common Files\\McAfee\\SystemCore\\mcshield.exe""}]}}"
844625,844625,2012-03-14 05:41:48.9444910,4663,LogAlways,Microsoft-Windows-Security-Auditing,Security,4,68,WKS-WIN764BITB.shieldbase.local,1
844665,844665,2012-03-14 05:42:38.0229301,4624,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,3052,WKS-WIN764BITB.shieldbase.local,12,,Successful logon,-\-,WKS-WIN732BITA (10.3.58.5),Target: NT AUTHORITY\ANONYMOUS LOGON,LogonType 3,LogonId: 0x3E0823B,AuthenticationPackageName: NTLM,"LogonProcessName: NtLmSsp ",,-,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-16-05-06-31-812.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-0-0""},{""@Name"":""SubjectUserName"",""#text"":""-""},{""@Name"":""SubjectDomainName"",""#text"":""-""},{""@Name"":""SubjectLogonId"",""#text"":""0x0""},{""@Name"":""TargetUserSid"",""#text"":""S-1-5-7""},{""@Name"":""TargetUserName"",""#text"":""ANONYMOUS LOGON""},{""@Name"":""TargetDomainName"",""#text"":""NT AUTHORITY""},{""@Name"":""TargetLogonId"",""#text"":""0x3E0823B""},{""@Name"":""LogonType"",""#text"":""3""},{""@Name"":""LogonProcessName"",""#text"":""NtLmSsp ""},{""@Name"":""AuthenticationPackageName"",""#text"":""NTLM""},{""@Name"":""WorkstationName"",""#text"":""WKS-WIN732BITA""},{""@Name"":""LogonGuid"",""#text"":""00000000-0000-0000-0000-000000000000""},{""@Name"":""TransmittedServices"",""#text"":""-""},{""@Name"":""LmPackageName"",""#text"":""NTLM V1""},{""@Name"":""KeyLength"",""#text"":""128""},{""@Name"":""ProcessId"",""#text"":""0x0""},{""@Name"":""ProcessName"",""#text"":""-""},{""@Name"":""IpAddress"",""#text"":""10.3.58.5""},{""@Name"":""IpPort"",""#text"":""51295""}]}}"
844666,844666,2012-03-14 05:42:38.0541803,4624,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,3052,WKS-WIN764BITB.shieldbase.local,12,,Successful logon,-\-,WKS-WIN732BITA (10.3.58.5),Target: NT AUTHORITY\ANONYMOUS LOGON,LogonType 3,LogonId: 0x3E08249,AuthenticationPackageName: NTLM,"LogonProcessName: NtLmSsp ",,-,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-16-05-06-31-812.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-0-0""},{""@Name"":""SubjectUserName"",""#text"":""-""},{""@Name"":""SubjectDomainName"",""#text"":""-""},{""@Name"":""SubjectLogonId"",""#text"":""0x0""},{""@Name"":""TargetUserSid"",""#text"":""S-1-5-7""},{""@Name"":""TargetUserName"",""#text"":""ANONYMOUS LOGON""},{""@Name"":""TargetDomainName"",""#text"":""NT AUTHORITY""},{""@Name"":""TargetLogonId"",""#text"":""0x3E08249""},{""@Name"":""LogonType"",""#text"":""3""},{""@Name"":""LogonProcessName"",""#text"":""NtLmSsp ""},{""@Name"":""AuthenticationPackageName"",""#text"":""NTLM""},{""@Name"":""WorkstationName"",""#text"":""WKS-WIN732BITA""},{""@Name"":""LogonGuid"",""#text"":""00000000-0000-0000-0000-000000000000""},{""@Name"":""TransmittedServices"",""#text"":""-""},{""@Name"":""LmPackageName"",""#text"":""NTLM V1""},{""@Name"":""KeyLength"",""#text"":""128""},{""@Name"":""ProcessId"",""#text"":""0x0""},{""@Name"":""ProcessName"",""#text"":""-""},{""@Name"":""IpAddress"",""#text"":""10.3.58.5""},{""@Name"
844665,844665,2012-03-14 05:42:38.0229301,4624,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,3052,WKS-WIN764BITB.shieldbase.local,12,,Successful logon,-\-,WKS-WIN732BITA (10.3.58.5),Target: NT AUTHORITY\ANONYMOUS LOGON,LogonType 3,LogonId: 0x3E0823B,AuthenticationPackageName: NTLM,"LogonProcessName: NtLmSsp ",,-,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-16-05-06-31-812.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-0-0""},{""@Name"":""SubjectUserName"",""#text"":""-""},{""@Name"":""SubjectDomainName"",""#text"":""-""},{""@Name"":""SubjectLogonId"",""#text"":""0x0""},{""@Name"":""TargetUserSid"",""#text"":""S-1-5-7""},{""@Name"":""TargetUserName"",""#text"":""ANONYMOUS LOGON""},{""@Name"":""TargetDomainName"",""#text"":""NT AUTHORITY""},{""@Name"":""TargetLogonId"",""#text"":""0x3E0823B""},{""@Name"":""LogonType"",""#text"":""3""},{""@Name"":""LogonProcessName"",""#text"":""NtLmSsp ""},{""@Name"":""AuthenticationPackageName"",""#text"":""NTLM""},{""@Name"":""WorkstationName"",""#text"":""WKS-WIN732BITA""},{""@Name"":""LogonGuid"",""#text"":""00000000-0000-0000-0000-000000000000""},{""@Name"":""TransmittedServices"",""#text"":""-""},{""@Name"":""LmPackageName"",""#text"":""NTLM V1""},{""@Name"":""KeyLength"",""#text"":""128""},{""@Name"":""ProcessId"",""#text"":""0x0""},{""@Name"":""ProcessName"",""#text"":""-""},{""@Name"":""IpAddress"",""#text"":""10.3.58.5""},{""@Name"":""IpPort"",""#text"":""51295""}]}}"
844666,844666,2012-03-14 05:42:38.0541803,4624,LogAlways,Microsoft-Windows-Security-Auditing,Security,556,3052,WKS-WIN764BITB.shieldbase.local,12,,Successful logon,-\-,WKS-WIN732BITA (10.3.58.5),Target: NT AUTHORITY\ANONYMOUS LOGON,LogonType 3,LogonId: 0x3E08249,AuthenticationPackageName: NTLM,"LogonProcessName: NtLmSsp ",,-,False,/mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-16-05-06-31-812.evtx,Audit success,0,"{""EventData"":{""Data"":[{""@Name"":""SubjectUserSid"",""#text"":""S-1-0-0""},{""@Name"":""SubjectUserName"",""#text"":""-""},{""@Name"":""SubjectDomainName"",""#text"":""-""},{""@Name"":""SubjectLogonId"",""#text"":""0x0""},{""@Name"":""TargetUserSid"",""#text"":""S-1-5-7""},{""@Name"":""TargetUserName"",""#text"":""ANONYMOUS LOGON""},{""@Name"":""TargetDomainName"",""#text"":""NT AUTHORITY""},{""@Name"":""TargetLogonId"",""#text"":""0x3E08249""},{""@Name"":""LogonType"",""#text"":""3""},{""@Name"":""LogonProcessName"",""#text"":""NtLmSsp ""},{""@Name"":""AuthenticationPackageName"",""#text"":""NTLM""},{""@Name"":""WorkstationName"",""#text"":""WKS-WIN732BITA""},{""@Name"":""LogonGuid"",""#text"":""00000000-0000-0000-0000-000000000000""},{""@Name"":""TransmittedServices"",""#text"":""-""},{""@Name"":""LmPackageName"",""#text"":""NTLM V1""},{""@Name"":""KeyLength"",""#text"":""128""},{""@Name"":""ProcessId"",""#text"":""0x0""},{""@Name"":""ProcessName"",""#text"":""-""},{""@Name"":""IpAddress"",""#text"":""10.3.58.5""},{""@Name"
ERROR: Command blocked — redirection: write target '/dev/null;' resolves outside reports/ (resolved: /dev/null;)
----------------------------------------
----------------------------------------
----------------------------------------
----------------------------------------
----------------------------------------
----------------------------------------
----------------------------------------
Netman-1 Netman-2 NETMAN Netman NetMan NETMAN NetMan Netman Netman-1hbin Netman-2hbin
Domain DomainProfile DomainProfile TrustedDomainObject SAM_DOMAIN ICSDomain Domains SyncDomainWithMembership proquota.exe Domain Domain AllowDefaultCredentialsDomain AllowDefaultCredentialsWhenNTLMOnlyDomain AllowFreshCredentialsDomain AllowFreshCredentialsWhenNTLMOnlyDomain AllowSavedCredentialsDomain AllowSavedCredentialsWhenNTLMOnlyDomain DenyDefaultCredentialsDomain DenyFreshCredentialsDomain DenySavedCredentialsDomain disabledomaincredsR Domain- Domain UseDomainNameDevolution OtherDomainsm Domain disabledomaincredsR AllowDefaultCredentialsDomain AllowDefaultCredentialsWhenNTLMOnlyDomain AllowFreshCredentialsDomain
/mnt/nfury/Windows/System32/config/COMPONENTS.LOG2 /mnt/nfury/Windows/System32/config/SECURITY.LOG2 /mnt/nfury/Windows/System32/config/BCD-Template /mnt/nfury/Windows/System32/config/BCD-Template.LOG /mnt/nfury/Windows/System32/config/COMPONENTS /mnt/nfury/Windows/System32/config/COMPONENTS.LOG /mnt/nfury/Windows/System32/config/COMPONENTS.LOG1 /mnt/nfury/Windows/System32/config/DEFAULT /mnt/nfury/Windows/System32/config/DEFAULT.LOG /mnt/nfury/Windows/System32/config/DEFAULT.LOG1 /mnt/nfury/Windows/System32/config/DEFAULT.LOG2 /mnt/nfury/Windows/System32/config/netlogon.ftl /mnt/nfury/Windows/System32/config/RegBack/DEFAULT /mnt/nfury/Windows/System32/config/RegBack/DEFAULT.LOG1 /mnt/nfury/Windows/System32/config/RegBack/DEFAULT.LOG2 /mnt/nfury/Windows/System32/config/RegBack/SAM /mnt/nfury/Windows/System32/config/RegBack/SAM.LOG1 /mnt/nfury/Windows/System32/config/RegBack/SAM.LOG2 /mnt/nfury/Windows/System32/config/RegBack/SECURITY /mnt/nfury/Windows/System32/config/RegBack/SECURITY.LOG1
----------------------------------------
# Copyright (c) 1993-2009 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a '#' symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host # localhost name resolution is handled within DNS itself. # 127.0.0.1 localhost # ::1 localhost
----------------------------------------
----------------------------------------
----------------------------------------
----------------------------------------
----------------------------------------
/mnt/nfury/Users/rsydow/NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
/mnt/nfury/Users/rsydow/AppData/Local/Adobe/Acrobat/9.0/Updater/updater.log
/mnt/nfury/Users/rsydow/AppData/Local/Adobe/Reader 9.3/Setup Files/Reader9/abcpy.ini
/mnt/nfury/Users/rsydow/AppData/Local/Adobe/Reader 9.3/Setup Files/Reader9/AcroRead.msi
/mnt/nfury/Users/rsydow/AppData/Local/Adobe/Reader 9.3/Setup Files/Reader9/AdbeRdrUpd932_all_incr.msp
/mnt/nfury/Users/rsydow/AppData/Local/Adobe/Reader 9.3/Setup Files/Reader9/AdbeRdrUpd933_all_incr.msp
/mnt/nfury/Users/rsydow/AppData/Local/Adobe/Reader 9.3/Setup Files/Reader9/AdbeRdrUpd934_all_incr.msp
/mnt/nfury/Users/rsydow/AppData/Local/Adobe/Reader 9.3/Setup Files/Reader9/Data1.cab
/mnt/nfury/Users/rsydow/AppData/Local/Adobe/Reader 9.3/Setup Files/Reader9/Setup.exe
/mnt/nfury/Users/rsydow/AppData/Local/Adobe/Reader 9.3/Setup Files/Reader9/setup.ini
/mnt/nfury/Users/rsydow/AppData/Local/Adobe/Reader 9.3/Setup Files/Setup.exe
/mnt/nfury/Users/rsydow/AppData/Local/Adobe/Reader 9.3/Setup Files/setup.ini
/mnt/nfury/Users/rsydow/AppData/Local/Adobe/Updater6/aumLib.log
/mnt/nfury/Users/rsydow/AppData/Local/GDIPFONTCACHEV1.DAT
/mnt/nfury/Users/rsydow/AppData/Local/IconCache.db
/mnt/nfury/Users/rsydow/AppData/Local/McAfee Anti-Theft/VaultInfo.xml
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/DIMS/state.dat
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/DIMS/state.da~
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Event Viewer/RecentViews
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Event Viewer/Settings.Xml
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds/Feeds for United States~/Popular Government Questions from USA~dgov~.feed-ms
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds/Feeds for United States~/USA~dgov Updates~c News and Features~.feed-ms
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds/FeedsStore.feedsdb-ms
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds/Microsoft Feeds~/Microsoft at Home~.feed-ms
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds/Microsoft Feeds~/Microsoft at Work~.feed-ms
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds/Microsoft Feeds~/MSNBC News~.feed-ms
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds/{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~/WebSlices~/Suggested Sites~.feed-ms
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds/{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~/WebSlices~/Web Slice Gallery~.feed-ms
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds Cache/1RMRJ509/desktop.ini
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds Cache/1RMRJ509/fwlink[1]
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds Cache/1RMRJ509/fwlink[2]
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds Cache/desktop.ini
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds Cache/index.dat
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds Cache/JT5DZ1ZJ/desktop.ini
/mnt/nfury/Users/rsydow/AppData/Local/Microsoft/Feeds Cache/S0GA2ORM/desktop.ini
/mnt/nfury/Users
/mnt/nfury/Users/vibranium/NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/Explorer/thumbcache_1024.db
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/Explorer/thumbcache_256.db
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/Explorer/thumbcache_32.db
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/Explorer/thumbcache_96.db
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/Explorer/thumbcache_idx.db
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/Explorer/thumbcache_sr.db
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/History/desktop.ini
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/History/History.IE5/desktop.ini
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/History/History.IE5/index.dat
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/99VANX0H/desktop.ini
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/desktop.ini
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/index.dat
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/JG7CMGS6/desktop.ini
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/LJCOX5I1/desktop.ini
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/ZALVMI27/desktop.ini
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/Temporary Internet Files/desktop.ini
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/UsrClass.dat
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/UsrClass.dat.LOG1
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/UsrClass.dat.LOG2
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/UsrClass.dat{63eeb309-7b85-11e1-8950-005056a50b40}.TM.blf
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/UsrClass.dat{63eeb309-7b85-11e1-8950-005056a50b40}.TMContainer00000000000000000001.regtrans-ms
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/UsrClass.dat{63eeb309-7b85-11e1-8950-005056a50b40}.TMContainer00000000000000000002.regtrans-ms
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/UsrClass.dat{c3b13e03-7ff1-11e1-8761-005056a50b40}.TM.blf
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/UsrClass.dat{c3b13e03-7ff1-11e1-8761-005056a50b40}.TMContainer00000000000000000001.regtrans-ms
/mnt/nfury/Users/vibranium/AppData/Local/Microsoft/Windows/UsrClass.dat{c3b13e03-7ff1-11e1-8761-005056a50b40}.TMContainer00000000000000000002.regtrans-ms
/mnt/nfury/Users/vibranium/AppData/Local/Temp/a.exe
/mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/bz2.pyd
/mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/Microsoft.VC90.CRT.manifest
/mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/msvcm90.dll
/mnt/nfury/Users/vibra
/mnt/nfury/Users/vibranium/AppData/Local/Temp/a.exe /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/bz2.pyd /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/Microsoft.VC90.CRT.manifest /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/msvcm90.dll /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/msvcp90.dll /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/msvcr90.dll /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/python27.dll /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/pywintypes27.dll /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/select.pyd /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/shell.exe.manifest /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/unicodedata.pyd /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/win32api.pyd /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/_hashlib.pyd /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/_socket.pyd /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/_ssl.pyd
/mnt/nfury/Windows/Temp/a.exe
/mnt/nfury/Windows/Temp/dd_clwireg.txt
/mnt/nfury/Windows/Temp/dd_dotNetFx40_Client_x86_x64_decompression_log.txt
/mnt/nfury/Windows/Temp/dd_NDP40-KB2468871-v2-x64_decompression_log.txt
/mnt/nfury/Windows/Temp/dd_SetupUtility.txt
/mnt/nfury/Windows/Temp/DMI6F26.tmp
/mnt/nfury/Windows/Temp/DMIF3E.tmp
/mnt/nfury/Windows/Temp/fwtsqmfile00.sqm
/mnt/nfury/Windows/Temp/fwtsqmfile01.sqm
/mnt/nfury/Windows/Temp/fwtsqmfile02.sqm
/mnt/nfury/Windows/Temp/fwtsqmfile03.sqm
/mnt/nfury/Windows/Temp/fwtsqmfile04.sqm
/mnt/nfury/Windows/Temp/FXSAPIDebugLogFile.txt
/mnt/nfury/Windows/Temp/{0BA28301-81E2-49B9-8EBC-CEDBF8BE4BD9}/ISBEW64.exe
/mnt/nfury/Windows/Temp/{0C725532-7854-4CB2-BC5E-AE62CF2F31C1}/ISBEW64.exe
/mnt/nfury/Windows/Temp/{14E939E8-1E09-4137-99D7-4A1A69F941F4}/ISBEW64.exe
/mnt/nfury/Windows/Temp/{2EB3EE51-5039-4F80-841D-1BCC0278A2CD}/ISBEW64.exe
/mnt/nfury/Windows/Temp/{4A85632C-1DB0-4F64-AC75-DF093CC8976A}/ISBEW64.exe
/mnt/nfury/Windows/Temp/{67B39F79-D666-4E56-A13A-A4AE12175A12}/ISBEW64.exe
/mnt/nfury/Windows/Temp/{7B93C49C-27E7-4462-A83C-193992F041D6}/ISBEW64.exe
/mnt/nfury/Windows/Temp/{906B95D3-908F-47B5-B61C-D18ECCE44A25}/ISBEW64.exe
/mnt/nfury/Windows/Temp/{947138A2-86DA-4345-A4FC-474BE7D1EC17}/ISBEW64.exe
/mnt/nfury/Windows/Temp/{C8EB8A23-75D7-400F-AA32-F489DBB8B3E5}/ISBEW64.exe
/mnt/nfury/Windows/Temp/{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}/nailite.dll
/mnt/nfury/Windows/Temp/{FD74F689-E167-4179-A992-81E04CCB6983}/ISBEW64.exe
/mnt/nfury/Windows/Temp/{FF94A483-B2D7-46D8-A93D-B03EB2EF173A}/ISBEW64.exe
/mnt/nfury/Windows/Temp/FXSTIFFDebugLogFile.txt
/mnt/nfury/Windows/Temp/KB2468871v2_20111016_031101021-Microsoft .NET Framework 4 Client Profile-MSP0.txt
/mnt/nfury/Windows/Temp/KB2468871v2_20111016_031101021.html
/mnt/nfury/Windows/Temp/KB2478663_20111014_030227081-Microsoft .NET Framework 4 Client Profile-MSP0.txt
File: /mnt/nfury/Users/vibranium/AppData/Local/Temp/_MEI65402/shell.exe.manifest
Size: 732 Blocks: 8 IO Block: 4096 regular file
Device: 7,11 Inode: 92636 Links: 2
Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2012-04-05 18:55:08.788936600 +0000
Modify: 2012-04-05 18:55:08.788936600 +0000
Change: 2012-04-05 18:55:08.788936600 +0000
Birth: -
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
<assemblyIdentity name="shell" processorArchitecture="x86" type="win32" version="1.0.0.0"/>
<dependency>
<dependentAssembly>
<assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="amd64" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.21022.8"/>
</dependentAssembly>
</dependency>
<dependency>
<dependentAssembly>
<assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>
</dependentAssembly>
</dependency>
</assembly>
File: /mnt/nfury/Windows/Temp/{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}/nailite.dll
Size: 562496 Blocks: 1104 IO Block: 4096 regular file
Device: 7,11 Inode: 62543 Links: 1
Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2011-09-16 20:55:12.387594000 +0000
Modify: 2011-09-16 20:55:12.574831200 +0000
Change: 2011-09-16 20:56:14.378710300 +0000
Birth: -
!This program cannot be run in DOS mode.
Richpo
.text
`.rdata
@.data
.rsrc
@.reloc
SVWf
DA$f
f3Dyd
\Y$f
f3\yd
\Y$f
f3\yd
\Y$f
f3\yd
\Y$f
f3\yd
\Y$f
f3\yd
\Y$f
f3\yd
\Y$f
f3\yd
\Y$f
f3\yd
\Y$f
f3\yd
\Y$f
f3\yd
\Y$f
f3\yd
\Y$f
f3\yd
\Y$f
f3\yd
\Y$f
f3\yd
\Y$f
f3\yd
/mnt/nfury/Users/Public/Temp/system4.rar /mnt/nfury/Users/Public/Temp/自述
File: /mnt/nfury/Users/Public/Temp/system4.rar Size: 6297428 Blocks: 12304 IO Block: 4096 regular file Device: 7,11 Inode: 37503 Links: 1 Access: (0777/-rwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2012-04-06 13:52:56.321257500 +0000 Modify: 2012-04-06 13:53:09.349937000 +0000 Change: 2012-04-06 13:53:09.349937000 +0000 Birth: - Rar! Zt~O ,c:4 n}_. l>r` f2$^ :Owp" 6mrp]@ %s;V @6swV_ s9gpy }8l+ _xAE $dCCq >h#J k:*_ &UxC5( xd1% [>82 78,q T/3- CUFT 8dOi = TSvgr$% #?fU ~ksm CqI)B"X #d:cB *O'\2 u=Xs
{
"file": "/mnt/nfury/Users/Public/Temp/system4.rar",
"algorithm": "md5",
"hash": "06a889b10ea9465e46554d6460f29bf2"
}
EvtxECmd version 1.5.2.0 Author: Eric Zimmerman (saericzimmerman@gmail.com) https://github.com/EricZimmerman/evtx Command line: -f /mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-16-05-09-58-802.evtx --csv /tmp/evtx_out --csvf evtx_arch4.csv CSV output will be saved to /tmp/evtx_out/evtx_arch4.csv Maps loaded: 453 Processing /mnt/nfury/Windows/System32/winevt/Logs/Archive-Security-2012-03-16-05-09-58-802.evtx... Chunk count: 64, Iterating records... Record #: 849528 (timestamp: 2012-03-16 05:06:31.2966710): Warning! Time just went backwards! Last seen time before change: 2012-03-16 05:06:41.0742030 Event log details Flags: None Chunk count: 64 Stored/Calculated CRC: 35956362/35956362 Earliest timestamp: 2012-03-16 05:06:31.2966710 Latest timestamp: 2012-03-16 05:09:58.8025609 Total event log records found: 5,799 Records included: 5,799 Errors: 0 Events dropped: 0 Metrics (including dropped events) Event ID Count 1104 1 1105 1 4624 2 4634 2 4663 5,793 Processed 1 file in 2.9651 seconds
/mnt/nfury/Windows/System32/winevt/Logs/Application.evtx /mnt/nfury/Windows/System32/winevt/Logs/HardwareEvents.evtx /mnt/nfury/Windows/System32/winevt/Logs/Internet Explorer.evtx /mnt/nfury/Windows/System32/winevt/Logs/Key Management Service.evtx /mnt/nfury/Windows/System32/winevt/Logs/Media Center.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-API-Tracing%4Operational.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-AppID%4Operational.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-AppLocker%4EXE and DLL.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-AppLocker%4MSI and Script.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-Application-Experience%4Problem-Steps-Recorder.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-Application-Experience%4Program-Inventory.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-Audio%4CaptureMonitor.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-Audio%4Operational.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-Authentication User Interface%4Operational.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-Backup.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker-DrivePreparationTool%4Admin.evtx /mnt/nfury/Windows/System32/winevt/Logs/Microsoft-Windows-BitLocker-DrivePreparationTool%4Operational.evtx
Possible reasons for this include: * You misspelled a built-in dotnet command. * You intended to execute a .NET program, but dotnet-/opt/zimmermantools/EvtxECmd.dll does not exist. * You intended to run a global tool, but a dotnet-prefixed executable with this name could not be found on the PATH.
15007 8 15008 8 20001 13 20003 10 20010 44 50036 18 50037 17 51046 18 51047 17 Processing /mnt/nfury/Windows/System32/winevt/Logs/HardwareEvents.evtx... Chunk count: 1, Iterating records... Event log details Flags: None Chunk count: 1 Stored/Calculated CRC: 6A858817/6A858817 Earliest timestamp: Latest timestamp: Total event log records found: 0 Records included: 0 Errors: 0 Events dropped: 0 Processed 162 files in 33.5078 seconds Files with errors /mnt/nfury/Windows/System32/winevt/Logs/Application.evtx error count: 1 /mnt/nfury/Windows/System32/winevt/Logs/Security.evtx error count: 1
ERROR: Command blocked — redirection: write target '/dev/null;' resolves outside reports/ (resolved: /dev/null;)