{"RuleName":"-","UtcTime":"2020-05-18T09:31:19.892","ProcessGuid":"{87a71a6b-55e7-5ec2-5750-01000000b000}","ProcessId":1176,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-55e7-5ec2-5650-01000000b000}","ParentProcessId":4548,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:31:23.648999999","ProcessGuid":"{87a71a6b-55eb-5ec2-5a50-01000000b000}","ProcessId":4440,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-55eb-5ec2-5950-01000000b000}","ParentProcessId":2948,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:31:27.267999999","ProcessGuid":"{87a71a6b-55ef-5ec2-5d50-01000000b000}","ProcessId":4132,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-55ef-5ec2-5c50-01000000b000}","ParentProcessId":2972,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:31:31.536","ProcessGuid":"{87a71a6b-55f3-5ec2-6050-01000000b000}","ProcessId":2616,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-55f3-5ec2-5f50-01000000b000}","ParentProcessId":1000,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:31:45.976","ProcessGuid":"{87a71a6b-5601-5ec2-6350-01000000b000}","ProcessId":2588,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5601-5ec2-6250-01000000b000}","ParentProcessId":4468,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:32:10.264","ProcessGuid":"{87a71a6b-561a-5ec2-6650-01000000b000}","ProcessId":4988,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-561a-5ec2-6550-01000000b000}","ParentProcessId":2720,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:32:26.235","ProcessGuid":"{87a71a6b-562a-5ec2-6950-01000000b000}","ProcessId":3904,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-562a-5ec2-6850-01000000b000}","ParentProcessId":2800,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:32:29.263","ProcessGuid":"{87a71a6b-562d-5ec2-6c50-01000000b000}","ProcessId":4748,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-562d-5ec2-6b50-01000000b000}","ParentProcessId":1060,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:32:29.578999999","ProcessGuid":"{87a71a6b-562d-5ec2-6d50-01000000b000}","ProcessId":1628,"Image":"C:\\Windows\\System32\\dllhost.exe","FileVersion":"10.0.17763.1 (WinBuild.160101.0800)","Description":"COM Surrogate","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dllhost.exe","CommandLine":"C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}","CurrentDirectory":"C:\\Windows\\system32\\","User":"EC2AMAZ-V0GPI6G\\Administrator","LogonGuid":"{87a71a6b-5693-5ebe-ede9-040000000000}","LogonId":322029,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=DCE2AF90E45FB9FC05ECBC9BEDDEE53FB66F3C6D","ParentProcessGuid":"{87a71a6b-54ec-5ebe-0d00-00000000b000}","ParentProcessId":840,"ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p"}
{"RuleName":"-","UtcTime":"2020-05-18T09:32:32.099","ProcessGuid":"{87a71a6b-5630-5ec2-7050-01000000b000}","ProcessId":3428,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5630-5ec2-6f50-01000000b000}","ParentProcessId":3208,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:32:37.152","ProcessGuid":"{87a71a6b-5635-5ec2-7250-01000000b000}","ProcessId":4620,"Image":"C:\\Windows\\System32\\dllhost.exe","FileVersion":"10.0.17763.1 (WinBuild.160101.0800)","Description":"COM Surrogate","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dllhost.exe","CommandLine":"C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}","CurrentDirectory":"C:\\Windows\\system32\\","User":"EC2AMAZ-V0GPI6G\\Administrator","LogonGuid":"{87a71a6b-5693-5ebe-ede9-040000000000}","LogonId":322029,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=DCE2AF90E45FB9FC05ECBC9BEDDEE53FB66F3C6D","ParentProcessGuid":"{87a71a6b-54ec-5ebe-0d00-00000000b000}","ParentProcessId":840,"ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p"}
{"RuleName":"-","UtcTime":"2020-05-18T09:32:51.824999999","ProcessGuid":"{87a71a6b-5643-5ec2-7450-01000000b000}","ProcessId":3340,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5643-5ec2-7350-01000000b000}","ParentProcessId":4588,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:32:59.264","ProcessGuid":"{87a71a6b-564b-5ec2-7750-01000000b000}","ProcessId":3336,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-564b-5ec2-7650-01000000b000}","ParentProcessId":4256,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:33:02.069","ProcessGuid":"{87a71a6b-564e-5ec2-7a50-01000000b000}","ProcessId":4528,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-564e-5ec2-7950-01000000b000}","ParentProcessId":3076,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:33:04.887","ProcessGuid":"{87a71a6b-5650-5ec2-7d50-01000000b000}","ProcessId":4276,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"EC2AMAZ-V0GPI6G\\Administrator","LogonGuid":"{87a71a6b-5693-5ebe-ede9-040000000000}","LogonId":322029,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5650-5ec2-7c50-01000000b000}","ParentProcessId":2940,"ParentImage":"C:\\Users\\Administrator\\winlogbeat-7.7.0-windows-x86_64\\winlogbeat.exe","ParentCommandLine":"\"C:\\Users\\Administrator\\winlogbeat-7.7.0-windows-x86_64\\winlogbeat.exe\" "}
{"RuleName":"-","UtcTime":"2020-05-18T09:33:08.891","ProcessGuid":"{87a71a6b-5654-5ec2-7e50-01000000b000}","ProcessId":540,"Image":"C:\\Program Files\\windows nt\\accessories\\wordpad.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Windows Wordpad Application","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"WORDPAD.EXE","CommandLine":"\"C:\\Program Files\\Windows NT\\Accessories\\WORDPAD.EXE\" \"C:\\Users\\Administrator\\winlogbeat-7.7.0-windows-x86_64\\winlogbeat.yml\"","CurrentDirectory":"C:\\Users\\Administrator\\winlogbeat-7.7.0-windows-x86_64\\","User":"EC2AMAZ-V0GPI6G\\Administrator","LogonGuid":"{87a71a6b-5693-5ebe-ede9-040000000000}","LogonId":322029,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=00CC94610D30D7F022F63BF9E7D823B20AFA5F21","ParentProcessGuid":"{87a71a6b-5695-5ebe-9700-00000000b000}","ParentProcessId":1844,"ParentImage":"C:\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE"}
{"RuleName":"-","UtcTime":"2020-05-18T09:33:38.468999999","ProcessGuid":"{87a71a6b-5672-5ec2-8050-01000000b000}","ProcessId":2428,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5672-5ec2-7f50-01000000b000}","ParentProcessId":2812,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:33:43.733999999","ProcessGuid":"{87a71a6b-5677-5ec2-8350-01000000b000}","ProcessId":2980,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5677-5ec2-8250-01000000b000}","ParentProcessId":4732,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:33:45.660","ProcessGuid":"{87a71a6b-5679-5ec2-8650-01000000b000}","ProcessId":3212,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5679-5ec2-8550-01000000b000}","ParentProcessId":5092,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:34:17.466","ProcessGuid":"{87a71a6b-5699-5ec2-8950-01000000b000}","ProcessId":3432,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5699-5ec2-8850-01000000b000}","ParentProcessId":2720,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:34:19.729","ProcessGuid":"{87a71a6b-569b-5ec2-8c50-01000000b000}","ProcessId":4300,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-569b-5ec2-8b50-01000000b000}","ParentProcessId":2300,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:34:32.482","ProcessGuid":"{87a71a6b-56a8-5ec2-8f50-01000000b000}","ProcessId":3452,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56a8-5ec2-8e50-01000000b000}","ParentProcessId":5088,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:34:46.095","ProcessGuid":"{87a71a6b-56b6-5ec2-9250-01000000b000}","ProcessId":1852,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56b6-5ec2-9150-01000000b000}","ParentProcessId":3208,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:34:51.798","ProcessGuid":"{87a71a6b-56bb-5ec2-9550-01000000b000}","ProcessId":4708,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56bb-5ec2-9450-01000000b000}","ParentProcessId":560,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:34:52.544","ProcessGuid":"{87a71a6b-56bc-5ec2-9850-01000000b000}","ProcessId":2660,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56bc-5ec2-9750-01000000b000}","ParentProcessId":2268,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:34:57.586","ProcessGuid":"{87a71a6b-56c1-5ec2-9b50-01000000b000}","ProcessId":712,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56c1-5ec2-9a50-01000000b000}","ParentProcessId":3092,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:34:58.623","ProcessGuid":"{87a71a6b-56c2-5ec2-9e50-01000000b000}","ProcessId":4120,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56c2-5ec2-9d50-01000000b000}","ParentProcessId":3876,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:35:04.262","ProcessGuid":"{87a71a6b-56c8-5ec2-a150-01000000b000}","ProcessId":3776,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56c8-5ec2-a050-01000000b000}","ParentProcessId":1892,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:35:09.292","ProcessGuid":"{87a71a6b-56cd-5ec2-a450-01000000b000}","ProcessId":2596,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56cd-5ec2-a350-01000000b000}","ParentProcessId":3184,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:35:15.119","ProcessGuid":"{87a71a6b-56d3-5ec2-a750-01000000b000}","ProcessId":4692,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56d3-5ec2-a650-01000000b000}","ParentProcessId":5072,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:35:26.083","ProcessGuid":"{87a71a6b-56de-5ec2-aa50-01000000b000}","ProcessId":4696,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56de-5ec2-a950-01000000b000}","ParentProcessId":3732,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:35:30.231","ProcessGuid":"{87a71a6b-56e2-5ec2-ad50-01000000b000}","ProcessId":4500,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56e2-5ec2-ac50-01000000b000}","ParentProcessId":3052,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:35:34.387","ProcessGuid":"{87a71a6b-56e6-5ec2-b050-01000000b000}","ProcessId":4128,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56e6-5ec2-af50-01000000b000}","ParentProcessId":3920,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:35:35.201","ProcessGuid":"{87a71a6b-56e7-5ec2-b350-01000000b000}","ProcessId":4676,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56e7-5ec2-b250-01000000b000}","ParentProcessId":4652,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:35:49.672","ProcessGuid":"{87a71a6b-56f5-5ec2-b650-01000000b000}","ProcessId":2696,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56f5-5ec2-b550-01000000b000}","ParentProcessId":4200,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:35:56.319","ProcessGuid":"{87a71a6b-56fc-5ec2-b950-01000000b000}","ProcessId":3592,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56fc-5ec2-b850-01000000b000}","ParentProcessId":4852,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:35:59.275999999","ProcessGuid":"{87a71a6b-56ff-5ec2-bc50-01000000b000}","ProcessId":4444,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-56ff-5ec2-bb50-01000000b000}","ParentProcessId":4308,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:36:14.275","ProcessGuid":"{87a71a6b-570e-5ec2-bf50-01000000b000}","ProcessId":3904,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-570e-5ec2-be50-01000000b000}","ParentProcessId":4092,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:36:27.523","ProcessGuid":"{87a71a6b-571b-5ec2-c250-01000000b000}","ProcessId":3668,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-571b-5ec2-c150-01000000b000}","ParentProcessId":4212,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:36:38.317","ProcessGuid":"{87a71a6b-5726-5ec2-c550-01000000b000}","ProcessId":2344,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5726-5ec2-c450-01000000b000}","ParentProcessId":4404,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:36:55.807999999","ProcessGuid":"{87a71a6b-5737-5ec2-c850-01000000b000}","ProcessId":4624,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5737-5ec2-c750-01000000b000}","ParentProcessId":712,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:37:01.725","ProcessGuid":"{87a71a6b-573d-5ec2-cb50-01000000b000}","ProcessId":4588,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-573d-5ec2-ca50-01000000b000}","ParentProcessId":504,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:37:03.134","ProcessGuid":"{87a71a6b-573f-5ec2-ce50-01000000b000}","ProcessId":4352,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-573f-5ec2-cd50-01000000b000}","ParentProcessId":4504,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:37:10.197","ProcessGuid":"{87a71a6b-5746-5ec2-d150-01000000b000}","ProcessId":4236,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5746-5ec2-d050-01000000b000}","ParentProcessId":4792,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:37:47.261","ProcessGuid":"{87a71a6b-576b-5ec2-d450-01000000b000}","ProcessId":4500,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-576b-5ec2-d350-01000000b000}","ParentProcessId":4180,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:38:06.110999999","ProcessGuid":"{87a71a6b-577e-5ec2-d750-01000000b000}","ProcessId":4188,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-577e-5ec2-d650-01000000b000}","ParentProcessId":4668,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:38:24.338","ProcessGuid":"{87a71a6b-5790-5ec2-da50-01000000b000}","ProcessId":4328,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5790-5ec2-d950-01000000b000}","ParentProcessId":3520,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:38:36.650","ProcessGuid":"{87a71a6b-579c-5ec2-dd50-01000000b000}","ProcessId":3232,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-579c-5ec2-dc50-01000000b000}","ParentProcessId":4904,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:38:38.066","ProcessGuid":"{87a71a6b-579e-5ec2-e050-01000000b000}","ProcessId":560,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-579e-5ec2-df50-01000000b000}","ParentProcessId":4396,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:38:38.158","ProcessGuid":"{87a71a6b-579e-5ec2-e250-01000000b000}","ProcessId":3884,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-579e-5ec2-e150-01000000b000}","ParentProcessId":3892,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:38:47.182","ProcessGuid":"{87a71a6b-57a7-5ec2-e450-01000000b000}","ProcessId":4772,"Image":"C:\\Windows\\System32\\taskhostw.exe","FileVersion":"10.0.17763.831 (WinBuild.160101.0800)","Description":"Host Process for Windows Tasks","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"taskhostw.exe","CommandLine":"taskhostw.exe NGCKeyPregen","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=77A6E223BF95348B3FA413B244CBB82598DAC9A2","ParentProcessGuid":"{87a71a6b-54ed-5ebe-1a00-00000000b000}","ParentProcessId":1268,"ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k netsvcs -p"}
{"RuleName":"-","UtcTime":"2020-05-18T09:38:53.391","ProcessGuid":"{87a71a6b-57ad-5ec2-e650-01000000b000}","ProcessId":4164,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57ad-5ec2-e550-01000000b000}","ParentProcessId":3308,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:38:53.927","ProcessGuid":"{87a71a6b-57ad-5ec2-e850-01000000b000}","ProcessId":4844,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57ad-5ec2-e750-01000000b000}","ParentProcessId":504,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:38:55.639","ProcessGuid":"{87a71a6b-57af-5ec2-ec50-01000000b000}","ProcessId":5096,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57af-5ec2-eb50-01000000b000}","ParentProcessId":688,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:38:56.625999999","ProcessGuid":"{87a71a6b-57b0-5ec2-ef50-01000000b000}","ProcessId":4888,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57b0-5ec2-ee50-01000000b000}","ParentProcessId":520,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:38:57.701999999","ProcessGuid":"{87a71a6b-57b1-5ec2-f250-01000000b000}","ProcessId":4584,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57b1-5ec2-f150-01000000b000}","ParentProcessId":5072,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:38:58.078999999","ProcessGuid":"{87a71a6b-57b2-5ec2-f550-01000000b000}","ProcessId":3964,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57b2-5ec2-f450-01000000b000}","ParentProcessId":4692,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:38:58.123","ProcessGuid":"{87a71a6b-57b2-5ec2-f750-01000000b000}","ProcessId":1584,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57b2-5ec2-f650-01000000b000}","ParentProcessId":1808,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:38:58.989","ProcessGuid":"{87a71a6b-57b2-5ec2-fb50-01000000b000}","ProcessId":880,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57b2-5ec2-fa50-01000000b000}","ParentProcessId":2204,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:39:00.307999999","ProcessGuid":"{87a71a6b-57b4-5ec2-fe50-01000000b000}","ProcessId":2940,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57b4-5ec2-fd50-01000000b000}","ParentProcessId":4740,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:39:02.634","ProcessGuid":"{87a71a6b-57b6-5ec2-0151-01000000b000}","ProcessId":2196,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57b6-5ec2-0051-01000000b000}","ParentProcessId":4268,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:39:05.029","ProcessGuid":"{87a71a6b-57b9-5ec2-0451-01000000b000}","ProcessId":1208,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57b9-5ec2-0351-01000000b000}","ParentProcessId":1096,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:39:07.966","ProcessGuid":"{87a71a6b-57bb-5ec2-0751-01000000b000}","ProcessId":5104,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57bb-5ec2-0651-01000000b000}","ParentProcessId":4068,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:39:10.152","ProcessGuid":"{87a71a6b-57be-5ec2-0a51-01000000b000}","ProcessId":3096,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57be-5ec2-0951-01000000b000}","ParentProcessId":3028,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:39:22.992","ProcessGuid":"{87a71a6b-57ca-5ec2-0d51-01000000b000}","ProcessId":4168,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57ca-5ec2-0c51-01000000b000}","ParentProcessId":2276,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:39:27.496","ProcessGuid":"{87a71a6b-57cf-5ec2-1051-01000000b000}","ProcessId":4176,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57cf-5ec2-0f51-01000000b000}","ParentProcessId":2800,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:39:28.510","ProcessGuid":"{87a71a6b-57d0-5ec2-1351-01000000b000}","ProcessId":3520,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57d0-5ec2-1251-01000000b000}","ParentProcessId":2528,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:39:31.134","ProcessGuid":"{87a71a6b-57d3-5ec2-1651-01000000b000}","ProcessId":2720,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57d3-5ec2-1551-01000000b000}","ParentProcessId":2124,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:39:35.999","ProcessGuid":"{87a71a6b-57d7-5ec2-1951-01000000b000}","ProcessId":3148,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-57d7-5ec2-1851-01000000b000}","ParentProcessId":4316,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:39:39.369","ProcessGuid":"{87a71a6b-57db-5ec2-1b51-01000000b000}","ProcessId":4904,"Image":"C:\\Program Files\\windows nt\\accessories\\wordpad.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Windows Wordpad Application","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"WORDPAD.EXE","CommandLine":"\"C:\\Program Files\\Windows NT\\Accessories\\WORDPAD.EXE\" \"C:\\Users\\Administrator\\winlogbeat-7.7.0-windows-x86_64\\winlogbeat.yml\"","CurrentDirectory":"C:\\Users\\Administrator\\winlogbeat-7.7.0-windows-x86_64\\","User":"EC2AMAZ-V0GPI6G\\Administrator","LogonGuid":"{87a71a6b-5693-5ebe-ede9-040000000000}","LogonId":322029,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=00CC94610D30D7F022F63BF9E7D823B20AFA5F21","ParentProcessGuid":"{87a71a6b-5695-5ebe-9700-00000000b000}","ParentProcessId":1844,"ParentImage":"C:\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE"}
{"RuleName":"-","UtcTime":"2020-05-18T09:39:39.551","ProcessGuid":"{87a71a6b-57db-5ec2-1c51-01000000b000}","ProcessId":4356,"Image":"C:\\Program Files\\windows nt\\accessories\\wordpad.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Windows Wordpad Application","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"WORDPAD.EXE","CommandLine":"\"C:\\Program Files\\Windows NT\\Accessories\\WORDPAD.EXE\" \"C:\\Users\\Administrator\\winlogbeat-7.7.0-windows-x86_64\\winlogbeat.yml\"","CurrentDirectory":"C:\\Users\\Administrator\\winlogbeat-7.7.0-windows-x86_64\\","User":"EC2AMAZ-V0GPI6G\\Administrator","LogonGuid":"{87a71a6b-5693-5ebe-ede9-040000000000}","LogonId":322029,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=00CC94610D30D7F022F63BF9E7D823B20AFA5F21","ParentProcessGuid":"{87a71a6b-5695-5ebe-9700-00000000b000}","ParentProcessId":1844,"ParentImage":"C:\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE"}
{"RuleName":"-","UtcTime":"2020-05-18T09:39:56.358","ProcessGuid":"{87a71a6b-57ec-5ec2-1d51-01000000b000}","ProcessId":688,"Image":"C:\\Windows\\System32\\notepad.exe","FileVersion":"10.0.17763.475 (WinBuild.160101.0800)","Description":"Notepad","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"NOTEPAD.EXE","CommandLine":"\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\Administrator\\sysmon\\sysmon-config.xml.txt","CurrentDirectory":"C:\\Users\\Administrator\\sysmon\\","User":"EC2AMAZ-V0GPI6G\\Administrator","LogonGuid":"{87a71a6b-5693-5ebe-ede9-040000000000}","LogonId":322029,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=B6D237154F2E528F0B503B58B025862D66B02B73","ParentProcessGuid":"{87a71a6b-5695-5ebe-9700-00000000b000}","ParentProcessId":1844,"ParentImage":"C:\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE"}
{"RuleName":"-","UtcTime":"2020-05-18T09:40:03.237999999","ProcessGuid":"{87a71a6b-57f3-5ec2-1e51-01000000b000}","ProcessId":3888,"Image":"C:\\Windows\\System32\\notepad.exe","FileVersion":"10.0.17763.475 (WinBuild.160101.0800)","Description":"Notepad","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"NOTEPAD.EXE","CommandLine":"\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\Administrator\\sysmon\\sysmon-config.xml.txt","CurrentDirectory":"C:\\Users\\Administrator\\sysmon\\","User":"EC2AMAZ-V0GPI6G\\Administrator","LogonGuid":"{87a71a6b-5693-5ebe-ede9-040000000000}","LogonId":322029,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=B6D237154F2E528F0B503B58B025862D66B02B73","ParentProcessGuid":"{87a71a6b-5695-5ebe-9700-00000000b000}","ParentProcessId":1844,"ParentImage":"C:\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE"}
{"RuleName":"-","UtcTime":"2020-05-18T09:40:37.676","ProcessGuid":"{87a71a6b-5815-5ec2-2051-01000000b000}","ProcessId":2692,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5815-5ec2-1f51-01000000b000}","ParentProcessId":4120,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:40:42.300","ProcessGuid":"{87a71a6b-581a-5ec2-2351-01000000b000}","ProcessId":4484,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-581a-5ec2-2251-01000000b000}","ParentProcessId":4216,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:40:44.853","ProcessGuid":"{87a71a6b-581c-5ec2-2651-01000000b000}","ProcessId":3712,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-581c-5ec2-2551-01000000b000}","ParentProcessId":2616,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:40:45.459","ProcessGuid":"{87a71a6b-581d-5ec2-2951-01000000b000}","ProcessId":1148,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-581d-5ec2-2851-01000000b000}","ParentProcessId":4200,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:40:46.589999999","ProcessGuid":"{87a71a6b-581e-5ec2-2c51-01000000b000}","ProcessId":4708,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-581e-5ec2-2b51-01000000b000}","ParentProcessId":4380,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:04.737","ProcessGuid":"{87a71a6b-5830-5ec2-2f51-01000000b000}","ProcessId":4604,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5830-5ec2-2e51-01000000b000}","ParentProcessId":1972,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:06.657","ProcessGuid":"{87a71a6b-5832-5ec2-3251-01000000b000}","ProcessId":2476,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5832-5ec2-3151-01000000b000}","ParentProcessId":3216,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:12.915999999","ProcessGuid":"{87a71a6b-5838-5ec2-3451-01000000b000}","ProcessId":2800,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5838-5ec2-3351-01000000b000}","ParentProcessId":4300,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:15.850","ProcessGuid":"{8bcf3217-583b-5ec2-6115-00000000b000}","ProcessId":88,"Image":"C:\\Windows\\System32\\dllhost.exe","FileVersion":"10.0.17763.1 (WinBuild.160101.0800)","Description":"COM Surrogate","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dllhost.exe","CommandLine":"C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}","CurrentDirectory":"C:\\Windows\\system32\\","User":"EC2AMAZ-NP5R74L\\Administrator","LogonGuid":"{8bcf3217-5507-5ebe-3712-020000000000}","LogonId":135735,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=DCE2AF90E45FB9FC05ECBC9BEDDEE53FB66F3C6D","ParentProcessGuid":"{8bcf3217-54f6-5ebe-0d00-00000000b000}","ParentProcessId":840,"ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p"}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:19.794","ProcessGuid":"{87a71a6b-583f-5ec2-3751-01000000b000}","ProcessId":5088,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-583f-5ec2-3651-01000000b000}","ParentProcessId":5044,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:26.360999999","ProcessGuid":"{8bcf3217-5846-5ec2-6215-00000000b000}","ProcessId":2268,"Image":"C:\\Windows\\System32\\LogonUI.exe","FileVersion":"10.0.17763.1 (WinBuild.160101.0800)","Description":"Windows Logon User Interface Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"logonui.exe","CommandLine":"\"LogonUI.exe\" /flags:0x0 /state0:0xa2a6f855 /state1:0x41c64e6d","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{8bcf3217-54f5-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":2,"IntegrityLevel":"System","Hashes":"SHA1=E1AB36E5C3C1453C592E2901330EB13C5D29B351","ParentProcessGuid":"{8bcf3217-5505-5ebe-3200-00000000b000}","ParentProcessId":2732,"ParentImage":"C:\\Windows\\System32\\winlogon.exe","ParentCommandLine":"winlogon.exe"}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:26.432","ProcessGuid":"{8bcf3217-5846-5ec2-6315-00000000b000}","ProcessId":4112,"Image":"C:\\Windows\\System32\\TSTheme.exe","FileVersion":"10.0.17763.771 (WinBuild.160101.0800)","Description":"TSTheme Server Module","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"TSThemeS.exe","CommandLine":"C:\\Windows\\system32\\TSTheme.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"EC2AMAZ-NP5R74L\\Administrator","LogonGuid":"{8bcf3217-5507-5ebe-3712-020000000000}","LogonId":135735,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=9BF3F1EF045E15BF6B2B941A67BB4918222DB362","ParentProcessGuid":"{8bcf3217-54f6-5ebe-0d00-00000000b000}","ParentProcessId":840,"ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p"}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:26.538999999","ProcessGuid":"{8bcf3217-5846-5ec2-6415-00000000b000}","ProcessId":3812,"Image":"C:\\Windows\\System32\\taskhostw.exe","FileVersion":"10.0.17763.831 (WinBuild.160101.0800)","Description":"Host Process for Windows Tasks","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"taskhostw.exe","CommandLine":"taskhostw.exe KEYROAMING","CurrentDirectory":"C:\\Windows\\system32\\","User":"EC2AMAZ-NP5R74L\\Administrator","LogonGuid":"{8bcf3217-5507-5ebe-3712-020000000000}","LogonId":135735,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=77A6E223BF95348B3FA413B244CBB82598DAC9A2","ParentProcessGuid":"{8bcf3217-54f7-5ebe-1a00-00000000b000}","ParentProcessId":1276,"ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k netsvcs -p"}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:29.652","ProcessGuid":"{87a71a6b-5849-5ec2-3a51-01000000b000}","ProcessId":3564,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5849-5ec2-3951-01000000b000}","ParentProcessId":4600,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:32.127999999","ProcessGuid":"{8bcf3217-584c-5ec2-6515-00000000b000}","ProcessId":4256,"Image":"C:\\Windows\\System32\\rdpclip.exe","FileVersion":"10.0.17763.1131 (WinBuild.160101.0800)","Description":"RDP Clipboard Monitor","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"rdpclip.exe","CommandLine":"rdpclip","CurrentDirectory":"C:\\Windows\\system32\\","User":"EC2AMAZ-NP5R74L\\Administrator","LogonGuid":"{8bcf3217-5507-5ebe-3712-020000000000}","LogonId":135735,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=0265C1718EC95B025D9719F3B4872826F8F4661F","ParentProcessGuid":"{8bcf3217-54f6-5ebe-1300-00000000b000}","ParentProcessId":824,"ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\System32\\svchost.exe -k termsvcs"}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:32.367","ProcessGuid":"{8bcf3217-584c-5ec2-6615-00000000b000}","ProcessId":4080,"Image":"C:\\Windows\\System32\\AtBroker.exe","FileVersion":"10.0.17763.1 (WinBuild.160101.0800)","Description":"Windows Assistive Technology Manager","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"ATBroker.exe","CommandLine":"atbroker.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{8bcf3217-54f5-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":2,"IntegrityLevel":"System","Hashes":"SHA1=5B9938BC8FB5158043063C55EB795884BE6F621C","ParentProcessGuid":"{8bcf3217-5505-5ebe-3200-00000000b000}","ParentProcessId":2732,"ParentImage":"C:\\Windows\\System32\\winlogon.exe","ParentCommandLine":"winlogon.exe"}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:32.377","ProcessGuid":"{8bcf3217-584c-5ec2-6715-00000000b000}","ProcessId":1336,"Image":"C:\\Windows\\System32\\LogonUI.exe","FileVersion":"10.0.17763.1 (WinBuild.160101.0800)","Description":"Windows Logon User Interface Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"logonui.exe","CommandLine":"\"LogonUI.exe\" /flags:0x0 /state0:0xa2a72855 /state1:0x41c64e6d","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{8bcf3217-54f5-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":2,"IntegrityLevel":"System","Hashes":"SHA1=E1AB36E5C3C1453C592E2901330EB13C5D29B351","ParentProcessGuid":"{8bcf3217-5505-5ebe-3200-00000000b000}","ParentProcessId":2732,"ParentImage":"C:\\Windows\\System32\\winlogon.exe","ParentCommandLine":"winlogon.exe"}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:32.977","ProcessGuid":"{8bcf3217-584c-5ec2-6815-00000000b000}","ProcessId":5072,"Image":"C:\\Windows\\System32\\sethc.exe","FileVersion":"10.0.17763.1 (WinBuild.160101.0800)","Description":"Accessibility shortcut keys","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"sethc.exe","CommandLine":"\"C:\\Windows\\System32\\Sethc.exe\" /AccessibilitySoundAgent","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{8bcf3217-54f5-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":2,"IntegrityLevel":"System","Hashes":"SHA1=F8DF7CD7482FCF621924C97BBB44DF380CC612BB","ParentProcessGuid":"{8bcf3217-584c-5ec2-6615-00000000b000}","ParentProcessId":4080,"ParentImage":"C:\\Windows\\System32\\AtBroker.exe","ParentCommandLine":"atbroker.exe"}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:33.637","ProcessGuid":"{8bcf3217-584d-5ec2-6915-00000000b000}","ProcessId":848,"Image":"C:\\Windows\\System32\\AtBroker.exe","FileVersion":"10.0.17763.1 (WinBuild.160101.0800)","Description":"Windows Assistive Technology Manager","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"ATBroker.exe","CommandLine":"atbroker.exe","CurrentDirectory":"C:\\Windows\\system32\\","User":"EC2AMAZ-NP5R74L\\Administrator","LogonGuid":"{8bcf3217-5507-5ebe-3712-020000000000}","LogonId":135735,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=5B9938BC8FB5158043063C55EB795884BE6F621C","ParentProcessGuid":"{8bcf3217-5505-5ebe-3200-00000000b000}","ParentProcessId":2732,"ParentImage":"C:\\Windows\\System32\\winlogon.exe","ParentCommandLine":"winlogon.exe"}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:33.992","ProcessGuid":"{8bcf3217-584d-5ec2-6a15-00000000b000}","ProcessId":4820,"Image":"C:\\Windows\\System32\\taskhostw.exe","FileVersion":"10.0.17763.831 (WinBuild.160101.0800)","Description":"Host Process for Windows Tasks","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"taskhostw.exe","CommandLine":"taskhostw.exe KEYROAMING","CurrentDirectory":"C:\\Windows\\system32\\","User":"EC2AMAZ-NP5R74L\\Administrator","LogonGuid":"{8bcf3217-5507-5ebe-3712-020000000000}","LogonId":135735,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=77A6E223BF95348B3FA413B244CBB82598DAC9A2","ParentProcessGuid":"{8bcf3217-54f7-5ebe-1a00-00000000b000}","ParentProcessId":1276,"ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k netsvcs -p"}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:37.517","ProcessGuid":"{87a71a6b-5851-5ec2-3c51-01000000b000}","ProcessId":712,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5851-5ec2-3b51-01000000b000}","ParentProcessId":5004,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:41.417999999","ProcessGuid":"{8bcf3217-5855-5ec2-6b15-00000000b000}","ProcessId":4656,"Image":"C:\\Windows\\System32\\dllhost.exe","FileVersion":"10.0.17763.1 (WinBuild.160101.0800)","Description":"COM Surrogate","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dllhost.exe","CommandLine":"C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}","CurrentDirectory":"C:\\Windows\\system32\\","User":"EC2AMAZ-NP5R74L\\Administrator","LogonGuid":"{8bcf3217-5507-5ebe-3712-020000000000}","LogonId":135735,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=DCE2AF90E45FB9FC05ECBC9BEDDEE53FB66F3C6D","ParentProcessGuid":"{8bcf3217-54f6-5ebe-0d00-00000000b000}","ParentProcessId":840,"ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p"}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:41.612","ProcessGuid":"{87a71a6b-5855-5ec2-4051-01000000b000}","ProcessId":3916,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5855-5ec2-3f51-01000000b000}","ParentProcessId":4588,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:41:47.165999999","ProcessGuid":"{8bcf3217-585b-5ec2-6c15-00000000b000}","ProcessId":1852,"Image":"C:\\Windows\\System32\\dllhost.exe","FileVersion":"10.0.17763.1 (WinBuild.160101.0800)","Description":"COM Surrogate","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dllhost.exe","CommandLine":"C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}","CurrentDirectory":"C:\\Windows\\system32\\","User":"EC2AMAZ-NP5R74L\\Administrator","LogonGuid":"{8bcf3217-5507-5ebe-3712-020000000000}","LogonId":135735,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=DCE2AF90E45FB9FC05ECBC9BEDDEE53FB66F3C6D","ParentProcessGuid":"{8bcf3217-54f6-5ebe-0d00-00000000b000}","ParentProcessId":840,"ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p"}
{"RuleName":"-","UtcTime":"2020-05-18T09:42:38.983999999","ProcessGuid":"{8bcf3217-588e-5ec2-6e15-00000000b000}","ProcessId":4680,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{8bcf3217-54f5-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{8bcf3217-588e-5ec2-6d15-00000000b000}","ParentProcessId":3336,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:42:40.443","ProcessGuid":"{8bcf3217-5890-5ec2-7015-00000000b000}","ProcessId":172,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{8bcf3217-54f5-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{8bcf3217-5890-5ec2-6f15-00000000b000}","ParentProcessId":3440,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:42:40.489","ProcessGuid":"{8bcf3217-5890-5ec2-7215-00000000b000}","ProcessId":1256,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{8bcf3217-54f5-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{8bcf3217-5890-5ec2-7115-00000000b000}","ParentProcessId":668,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:42:45.778","ProcessGuid":"{87a71a6b-5895-5ec2-4451-01000000b000}","ProcessId":520,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5895-5ec2-4351-01000000b000}","ParentProcessId":3784,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:42:47.279","ProcessGuid":"{87a71a6b-5897-5ec2-4751-01000000b000}","ProcessId":4440,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5897-5ec2-4651-01000000b000}","ParentProcessId":3808,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:42:48.051","ProcessGuid":"{87a71a6b-5898-5ec2-4951-01000000b000}","ProcessId":4240,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5898-5ec2-4851-01000000b000}","ParentProcessId":4036,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:42:49.402","ProcessGuid":"{87a71a6b-5899-5ec2-4d51-01000000b000}","ProcessId":4916,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5899-5ec2-4c51-01000000b000}","ParentProcessId":1832,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:42:52.008","ProcessGuid":"{87a71a6b-589c-5ec2-5051-01000000b000}","ProcessId":3028,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-589c-5ec2-4f51-01000000b000}","ParentProcessId":2620,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:42:52.014","ProcessGuid":"{8bcf3217-589c-5ec2-7615-00000000b000}","ProcessId":500,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{8bcf3217-54f5-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{8bcf3217-589c-5ec2-7515-00000000b000}","ParentProcessId":4456,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:43:04.154","ProcessGuid":"{87a71a6b-58a8-5ec2-5351-01000000b000}","ProcessId":2616,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58a8-5ec2-5251-01000000b000}","ParentProcessId":4736,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:43:09.273999999","ProcessGuid":"{87a71a6b-58ad-5ec2-5651-01000000b000}","ProcessId":3664,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58ad-5ec2-5551-01000000b000}","ParentProcessId":3812,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:43:16.284","ProcessGuid":"{87a71a6b-58b4-5ec2-5951-01000000b000}","ProcessId":4468,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58b4-5ec2-5851-01000000b000}","ParentProcessId":2588,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:43:19.477","ProcessGuid":"{87a71a6b-58b7-5ec2-5c51-01000000b000}","ProcessId":4796,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58b7-5ec2-5b51-01000000b000}","ParentProcessId":2276,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:43:26.228","ProcessGuid":"{87a71a6b-58be-5ec2-5f51-01000000b000}","ProcessId":4472,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58be-5ec2-5e51-01000000b000}","ParentProcessId":2012,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:43:32.148","ProcessGuid":"{87a71a6b-58c4-5ec2-6251-01000000b000}","ProcessId":3588,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58c4-5ec2-6151-01000000b000}","ParentProcessId":3796,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:43:32.682","ProcessGuid":"{87a71a6b-58c4-5ec2-6551-01000000b000}","ProcessId":5044,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58c4-5ec2-6451-01000000b000}","ParentProcessId":668,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:43:40.266","ProcessGuid":"{87a71a6b-58cc-5ec2-6851-01000000b000}","ProcessId":1188,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58cc-5ec2-6751-01000000b000}","ParentProcessId":4312,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:43:44.687","ProcessGuid":"{87a71a6b-58d0-5ec2-6b51-01000000b000}","ProcessId":3608,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58d0-5ec2-6a51-01000000b000}","ParentProcessId":4600,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:43:49.936","ProcessGuid":"{87a71a6b-58d5-5ec2-6e51-01000000b000}","ProcessId":1180,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58d5-5ec2-6d51-01000000b000}","ParentProcessId":4824,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:43:54.824","ProcessGuid":"{87a71a6b-58da-5ec2-7151-01000000b000}","ProcessId":3292,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58da-5ec2-7051-01000000b000}","ParentProcessId":4464,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:44:03.269","ProcessGuid":"{87a71a6b-58e3-5ec2-7351-01000000b000}","ProcessId":4416,"Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","FileVersion":"10.0.17763.1 (WinBuild.160101.0800)","Description":"Windows PowerShell","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"PowerShell.EXE","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ","CurrentDirectory":"C:\\Users\\Administrator\\","User":"EC2AMAZ-V0GPI6G\\Administrator","LogonGuid":"{87a71a6b-5693-5ebe-ede9-040000000000}","LogonId":322029,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=6CBCE4A295C163791B60FC23D285E6D84F28EE4C","ParentProcessGuid":"{87a71a6b-5695-5ebe-9700-00000000b000}","ParentProcessId":1844,"ParentImage":"C:\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE"}
{"RuleName":"-","UtcTime":"2020-05-18T09:44:03.358999999","ProcessGuid":"{87a71a6b-58e3-5ec2-7451-01000000b000}","ProcessId":4080,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"EC2AMAZ-V0GPI6G\\Administrator","LogonGuid":"{87a71a6b-5693-5ebe-ede9-040000000000}","LogonId":322029,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58e3-5ec2-7351-01000000b000}","ParentProcessId":4416,"ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" "}
{"RuleName":"-","UtcTime":"2020-05-18T09:44:10.400999999","ProcessGuid":"{87a71a6b-58ea-5ec2-7651-01000000b000}","ProcessId":4368,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58ea-5ec2-7551-01000000b000}","ParentProcessId":4280,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:44:14.785","ProcessGuid":"{87a71a6b-58ee-5ec2-7951-01000000b000}","ProcessId":1808,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58ee-5ec2-7851-01000000b000}","ParentProcessId":4848,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:44:16.600","ProcessGuid":"{87a71a6b-58f0-5ec2-7c51-01000000b000}","ProcessId":4408,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-58f0-5ec2-7b51-01000000b000}","ParentProcessId":4476,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:45:00.093","ProcessGuid":"{87a71a6b-591c-5ec2-8051-01000000b000}","ProcessId":2696,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-591c-5ec2-7f51-01000000b000}","ParentProcessId":3872,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:45:05.580","ProcessGuid":"{87a71a6b-5921-5ec2-8251-01000000b000}","ProcessId":4276,"Image":"C:\\Windows\\System32\\notepad.exe","FileVersion":"10.0.17763.475 (WinBuild.160101.0800)","Description":"Notepad","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"NOTEPAD.EXE","CommandLine":"\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\Administrator\\sysmon\\sysmon-config.xml.txt","CurrentDirectory":"C:\\Users\\Administrator\\sysmon\\","User":"EC2AMAZ-V0GPI6G\\Administrator","LogonGuid":"{87a71a6b-5693-5ebe-ede9-040000000000}","LogonId":322029,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=B6D237154F2E528F0B503B58B025862D66B02B73","ParentProcessGuid":"{87a71a6b-5695-5ebe-9700-00000000b000}","ParentProcessId":1844,"ParentImage":"C:\\Windows\\explorer.exe","ParentCommandLine":"C:\\Windows\\Explorer.EXE"}
{"RuleName":"-","UtcTime":"2020-05-18T09:45:15.373","ProcessGuid":"{87a71a6b-592b-5ec2-8451-01000000b000}","ProcessId":4516,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-592b-5ec2-8351-01000000b000}","ParentProcessId":1252,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:45:28.445","ProcessGuid":"{87a71a6b-5938-5ec2-8651-01000000b000}","ProcessId":4328,"Image":"C:\\Windows\\System32\\dllhost.exe","FileVersion":"10.0.17763.1 (WinBuild.160101.0800)","Description":"COM Surrogate","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dllhost.exe","CommandLine":"C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}","CurrentDirectory":"C:\\Windows\\system32\\","User":"EC2AMAZ-V0GPI6G\\Administrator","LogonGuid":"{87a71a6b-5693-5ebe-ede9-040000000000}","LogonId":322029,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=DCE2AF90E45FB9FC05ECBC9BEDDEE53FB66F3C6D","ParentProcessGuid":"{87a71a6b-54ec-5ebe-0d00-00000000b000}","ParentProcessId":840,"ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p"}
{"RuleName":"-","UtcTime":"2020-05-18T09:45:29.549","ProcessGuid":"{87a71a6b-5939-5ec2-8851-01000000b000}","ProcessId":2328,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5939-5ec2-8751-01000000b000}","ParentProcessId":4116,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:45:37.170","ProcessGuid":"{87a71a6b-5941-5ec2-8b51-01000000b000}","ProcessId":2012,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5941-5ec2-8a51-01000000b000}","ParentProcessId":3100,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:45:42.881","ProcessGuid":"{87a71a6b-5946-5ec2-8e51-01000000b000}","ProcessId":3124,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5946-5ec2-8d51-01000000b000}","ParentProcessId":3588,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:45:50.491","ProcessGuid":"{87a71a6b-594e-5ec2-9051-01000000b000}","ProcessId":5088,"Image":"C:\\Windows\\System32\\OpenWith.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Pick an app","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"OpenWith.exe","CommandLine":"C:\\Windows\\system32\\OpenWith.exe -Embedding","CurrentDirectory":"C:\\Windows\\system32\\","User":"EC2AMAZ-V0GPI6G\\Administrator","LogonGuid":"{87a71a6b-5693-5ebe-ede9-040000000000}","LogonId":322029,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=96328A6316797B1AD90DF0FE7855F36D01D77A44","ParentProcessGuid":"{87a71a6b-54ec-5ebe-0d00-00000000b000}","ParentProcessId":840,"ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p"}
{"RuleName":"-","UtcTime":"2020-05-18T09:45:55.307999999","ProcessGuid":"{87a71a6b-5953-5ec2-9251-01000000b000}","ProcessId":2544,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5953-5ec2-9151-01000000b000}","ParentProcessId":4776,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:45:55.760","ProcessGuid":"{87a71a6b-5953-5ec2-9551-01000000b000}","ProcessId":3564,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5953-5ec2-9451-01000000b000}","ParentProcessId":4844,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:45:58.569","ProcessGuid":"{87a71a6b-5956-5ec2-9851-01000000b000}","ProcessId":2180,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5956-5ec2-9751-01000000b000}","ParentProcessId":4612,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:46:02.534","ProcessGuid":"{87a71a6b-595a-5ec2-9b51-01000000b000}","ProcessId":3724,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-595a-5ec2-9a51-01000000b000}","ParentProcessId":480,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:46:02.742","ProcessGuid":"{87a71a6b-595a-5ec2-9d51-01000000b000}","ProcessId":3400,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-595a-5ec2-9c51-01000000b000}","ParentProcessId":3992,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:46:11.262","ProcessGuid":"{87a71a6b-5963-5ec2-a151-01000000b000}","ProcessId":4632,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5963-5ec2-a051-01000000b000}","ParentProcessId":3968,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:46:16.519","ProcessGuid":"{87a71a6b-5968-5ec2-a451-01000000b000}","ProcessId":4532,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5968-5ec2-a351-01000000b000}","ParentProcessId":4924,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:46:27.494","ProcessGuid":"{87a71a6b-5973-5ec2-a651-01000000b000}","ProcessId":3876,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5973-5ec2-a551-01000000b000}","ParentProcessId":4360,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:46:28.500","ProcessGuid":"{87a71a6b-5974-5ec2-a851-01000000b000}","ProcessId":4640,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5974-5ec2-a751-01000000b000}","ParentProcessId":2572,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:46:34.639","ProcessGuid":"{87a71a6b-597a-5ec2-ac51-01000000b000}","ProcessId":3768,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-597a-5ec2-ab51-01000000b000}","ParentProcessId":3120,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:46:41.526","ProcessGuid":"{87a71a6b-5981-5ec2-af51-01000000b000}","ProcessId":4676,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5981-5ec2-ae51-01000000b000}","ParentProcessId":4976,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:46:54.124","ProcessGuid":"{87a71a6b-598e-5ec2-b251-01000000b000}","ProcessId":3444,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-598e-5ec2-b151-01000000b000}","ParentProcessId":4100,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:46:56.425","ProcessGuid":"{87a71a6b-5990-5ec2-b551-01000000b000}","ProcessId":4708,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5990-5ec2-b451-01000000b000}","ParentProcessId":4420,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:46:57.334","ProcessGuid":"{87a71a6b-5991-5ec2-b851-01000000b000}","ProcessId":4716,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5991-5ec2-b751-01000000b000}","ParentProcessId":4692,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:47:02.384","ProcessGuid":"{87a71a6b-5996-5ec2-bb51-01000000b000}","ProcessId":4508,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-5996-5ec2-ba51-01000000b000}","ParentProcessId":1600,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:47:27.334","ProcessGuid":"{8bcf3217-59af-5ec2-7815-00000000b000}","ProcessId":3988,"Image":"C:\\Windows\\System32\\dllhost.exe","FileVersion":"10.0.17763.1 (WinBuild.160101.0800)","Description":"COM Surrogate","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"dllhost.exe","CommandLine":"C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}","CurrentDirectory":"C:\\Windows\\system32\\","User":"EC2AMAZ-NP5R74L\\Administrator","LogonGuid":"{8bcf3217-5507-5ebe-3712-020000000000}","LogonId":135735,"TerminalSessionId":2,"IntegrityLevel":"High","Hashes":"SHA1=DCE2AF90E45FB9FC05ECBC9BEDDEE53FB66F3C6D","ParentProcessGuid":"{8bcf3217-54f6-5ebe-0d00-00000000b000}","ParentProcessId":840,"ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p"}
{"RuleName":"-","UtcTime":"2020-05-18T09:47:31.152","ProcessGuid":"{87a71a6b-59b3-5ec2-be51-01000000b000}","ProcessId":3404,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-59b3-5ec2-bd51-01000000b000}","ParentProcessId":3680,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:47:41.236","ProcessGuid":"{87a71a6b-59bd-5ec2-c151-01000000b000}","ProcessId":2776,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-59bd-5ec2-c051-01000000b000}","ParentProcessId":4372,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:47:51.758","ProcessGuid":"{87a71a6b-59c7-5ec2-c451-01000000b000}","ProcessId":4332,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-59c7-5ec2-c351-01000000b000}","ParentProcessId":4836,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:47:54.801","ProcessGuid":"{87a71a6b-59ca-5ec2-c751-01000000b000}","ProcessId":1528,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-59ca-5ec2-c651-01000000b000}","ParentProcessId":1292,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:47:55.697","ProcessGuid":"{87a71a6b-59cb-5ec2-ca51-01000000b000}","ProcessId":3992,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-59cb-5ec2-c951-01000000b000}","ParentProcessId":4948,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:48:03.412","ProcessGuid":"{87a71a6b-59d3-5ec2-cd51-01000000b000}","ProcessId":3380,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-59d3-5ec2-cc51-01000000b000}","ParentProcessId":2180,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:48:19.759","ProcessGuid":"{87a71a6b-59e3-5ec2-d051-01000000b000}","ProcessId":4000,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-59e3-5ec2-cf51-01000000b000}","ParentProcessId":4624,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:48:21.733","ProcessGuid":"{87a71a6b-59e5-5ec2-d351-01000000b000}","ProcessId":4572,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-59e5-5ec2-d251-01000000b000}","ParentProcessId":4120,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:48:21.832","ProcessGuid":"{87a71a6b-59e5-5ec2-d651-01000000b000}","ProcessId":2572,"Image":"C:\\Windows\\System32\\conhost.exe","FileVersion":"10.0.17763.1075 (WinBuild.160101.0800)","Description":"Console Window Host","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"CONHOST.EXE","CommandLine":"\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1","CurrentDirectory":"C:\\Windows","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{87a71a6b-54eb-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"SHA1=74F28DD9B0DA310D85F1931DB2749A26A9A8AB02","ParentProcessGuid":"{87a71a6b-59e5-5ec2-d551-01000000b000}","ParentProcessId":3920,"ParentImage":"C:\\Windows\\System32\\OpenSSH\\sshd.exe","ParentCommandLine":"\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" \"-R\""}
{"RuleName":"-","UtcTime":"2020-05-18T09:51:34.210","ProcessGuid":"{8bcf3217-5aa6-5ec2-7d15-00000000b000}","ProcessId":2580,"Image":"C:\\Windows\\System32\\taskhostw.exe","FileVersion":"10.0.17763.831 (WinBuild.160101.0800)","Description":"Host Process for Windows Tasks","Product":"Microsoft® Windows® Operating System","Company":"Microsoft Corporation","OriginalFileName":"taskhostw.exe","CommandLine":"taskhostw.exe NGCKeyPregen","CurrentDirectory":"C:\\Windows\\system32\\","User":"NT AUTHORITY\\SYSTEM","LogonGuid":"{8bcf3217-54f5-5ebe-e703-000000000000}","LogonId":999,"TerminalSessionId":0,"IntegrityLevel":"System","Hashes":"MD5=106B2AEC107DFD22DB51C7A1B29623F8,SHA256=CA620F4DE4A426F129445E4D8A545B7B08B021080E7375A3EA3ED8C8A7212A8F,IMPHASH=9839C7FD9649496B162F72128209528A","ParentProcessGuid":"{8bcf3217-54f7-5ebe-1a00-00000000b000}","ParentProcessId":1276,"ParentImage":"C:\\Windows\\System32\\svchost.exe","ParentCommandLine":"C:\\Windows\\system32\\svchost.exe -k netsvcs -p"}
