Hostnames |
client-104-168-219-130.hostwindsdns.com erp.welbornconsult.com erpdemo.welbornconsult.com |
Domains | hostwindsdns.com welbornconsult.com |
Country | United States |
City | Seattle |
Organization | Hostwinds Seattle |
ISP | Hostwinds LLC. |
ASN | AS54290 |
-86494471 | 2024-04-17T05:25:34.62190880 / tcp
HTTP/1.1 307 Temporary Redirect Transfer-Encoding: chunked Location: https://104.168.219.130/ Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Wed, 17 Apr 2024 05:25:34 GMT
-598793347 | 2024-04-20T22:38:39.246377135 / tcp
Microsoft RPC Endpoint Mapper d95afe70-a6d5-4259-822e-2c84da1ddb0d version: v1.0 protocol: [MS-RSP]: Remote Shutdown Protocol provider: wininit.exe ncacn_ip_tcp: 104.168.219.130:49664 ncalrpc: WindowsShutdown ncacn_np: \\HWC-HWP-4998980\PIPE\InitShutdown ncalrpc: WMsgKRpc039F20 76f226c3-ec14-4325-8a99-6a46348418af version: v1.0 provider: winlogon.exe ncalrpc: WindowsShutdown ncacn_np: \\HWC-HWP-4998980\PIPE\InitShutdown ncalrpc: WMsgKRpc039F20 ncalrpc: WMsgKRpc03A741 ncalrpc: WMsgKRpc024B4752 fc48cd89-98d6-4628-9839-86f7a3e4161a version: v1.0 ncalrpc: LRPC-ede3d68b3dfd4e0d20 ncalrpc: dabrpc ncalrpc: csebpub ncalrpc: LRPC-9696d1b112313baea1 ncalrpc: LRPC-063b1cf41c172a49ed ncalrpc: LRPC-f56b2e5b595930b645 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo 9b008953-f195-4bf9-bde0-4471971e58ed version: v1.0 ncalrpc: LRPC-ede3d68b3dfd4e0d20 ncalrpc: dabrpc ncalrpc: csebpub ncalrpc: LRPC-9696d1b112313baea1 ncalrpc: LRPC-063b1cf41c172a49ed ncalrpc: LRPC-f56b2e5b595930b645 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo d09bdeb5-6171-4a34-bfe2-06fa82652568 version: v1.0 ncalrpc: csebpub ncalrpc: LRPC-9696d1b112313baea1 ncalrpc: LRPC-063b1cf41c172a49ed ncalrpc: LRPC-f56b2e5b595930b645 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo ncalrpc: LRPC-063b1cf41c172a49ed ncalrpc: LRPC-f56b2e5b595930b645 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo ncalrpc: LRPC-41ca21362fef1a0bc2 ncalrpc: dhcpcsvc ncalrpc: dhcpcsvc6 ncacn_ip_tcp: 104.168.219.130:49665 ncacn_np: \\HWC-HWP-4998980\pipe\eventlog ncalrpc: eventlog ncalrpc: LRPC-58e976ac4a70b4c675 ncalrpc: LRPC-c1507e07e36ee07c44 ncalrpc: LRPC-b94c0d491ce5706fc2 ncalrpc: LRPC-d9837a61b8beb6cafa ncalrpc: OLE4F9290003188FE93F90386E78694 ncalrpc: IUserProfile2 697dcda9-3ba9-4eb2-9247-e11f1901b0d2 version: v1.0 ncalrpc: LRPC-9696d1b112313baea1 ncalrpc: LRPC-063b1cf41c172a49ed ncalrpc: LRPC-f56b2e5b595930b645 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo 857fb1be-084f-4fb5-b59c-4b2c4be5f0cf version: v1.0 ncalrpc: LRPC-f56b2e5b595930b645 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo b8cadbaf-e84b-46b9-84f2-6f71c03f9e55 version: v1.0 ncalrpc: LRPC-f56b2e5b595930b645 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo 20c40295-8dba-48e6-aebf-3e78ef3bb144 version: v1.0 ncalrpc: LRPC-f56b2e5b595930b645 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo 2513bcbe-6cd4-4348-855e-7efb3c336dd3 version: v1.0 ncalrpc: LRPC-f56b2e5b595930b645 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo 88abcbc3-34ea-76ae-8215-767520655a23 version: v0.0 ncalrpc: LRPC-f56b2e5b595930b645 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo 76c217bc-c8b4-4201-a745-373ad9032b1a version: v1.0 ncalrpc: LRPC-f56b2e5b595930b645 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo 55e6b932-1979-45d6-90c5-7f6270724112 version: v1.0 ncalrpc: LRPC-f56b2e5b595930b645 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo 4dace966-a243-4450-ae3f-9b7bcb5315b8 version: v1.0 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo 1832bcf6-cab8-41d4-85d2-c9410764f75a version: v1.0 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo c521facf-09a9-42c5-b155-72388595cbf0 version: v0.0 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo 2c7fd9ce-e706-4b40-b412-953107ef9bb0 version: v0.0 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo 0d3e2735-cea0-4ecc-a9e2-41a2d81aed4e version: v1.0 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo c605f9fb-f0a3-4e2a-a073-73560f8d9e3e version: v1.0 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo 1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0 version: v1.0 ncalrpc: OLE157689D4859142C90028BABB3697 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo 8bfc3be1-6def-4e2d-af74-7c47cd0ade4a version: v1.0 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo 2d98a740-581d-41b9-aa0d-a88b9d5ce938 version: v1.0 ncacn_np: \\HWC-HWP-4998980\pipe\LSM_API_service ncalrpc: LSMApi ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 version: v1.0 annotation: Impl friendly name provider: sysntfy.dll ncalrpc: LRPC-5d6569b11a4e7fe3fa ncalrpc: actkernel ncalrpc: umpo ncalrpc: senssvc ncalrpc: LRPC-1280200b2f93aaecb7 ncacn_ip_tcp: 104.168.219.130:54635 ncacn_np: \\HWC-HWP-4998980\pipe\SessEnvPublicRpc ncalrpc: SessEnvPrivateRpc ncalrpc: LRPC-b94c0d491ce5706fc2 ncalrpc: LRPC-d9837a61b8beb6cafa ncalrpc: OLE4F9290003188FE93F90386E78694 ncalrpc: IUserProfile2 ncalrpc: senssvc ncalrpc: LRPC-1280200b2f93aaecb7 ncacn_ip_tcp: 104.168.219.130:54635 ncacn_np: \\HWC-HWP-4998980\pipe\SessEnvPublicRpc ncalrpc: SessEnvPrivateRpc ncalrpc: LRPC-b94c0d491ce5706fc2 ncalrpc: LRPC-d9837a61b8beb6cafa ncalrpc: OLE4F9290003188FE93F90386E78694 ncalrpc: IUserProfile2 ncalrpc: LRPC-b94c0d491ce5706fc2 ncalrpc: LRPC-d9837a61b8beb6cafa ncalrpc: OLE4F9290003188FE93F90386E78694 ncalrpc: IUserProfile2 ncalrpc: IUserProfile2 5824833b-3c1a-4ad2-bdfd-c31d19e23ed2 version: v1.0 ncalrpc: actkernel ncalrpc: umpo bdaa0970-413b-4a3e-9e5d-f6dc9d7e0760 version: v1.0 ncalrpc: actkernel ncalrpc: umpo 3b338d89-6cfa-44b8-847e-531531bc9992 version: v1.0 ncalrpc: actkernel ncalrpc: umpo 8782d3b9-ebbd-4644-a3d8-e8725381919b version: v1.0 ncalrpc: actkernel ncalrpc: umpo 085b0334-e454-4d91-9b8c-4134f9e793f3 version: v1.0 ncalrpc: actkernel ncalrpc: umpo 4bec6bb8-b5c2-4b6f-b2c1-5da5cf92d0d9 version: v1.0 ncalrpc: actkernel ncalrpc: umpo f3f09ffd-fbcf-4291-944d-70ad6e0e73bb version: v1.0 ncalrpc: LRPC-e1350f6403eff87ed0 a500d4c6-0dd1-4543-bc0c-d5f93486eaf8 version: v1.0 ncalrpc: LRPC-0b9747f60d53ab4feb ncalrpc: LRPC-41ca21362fef1a0bc2 ncalrpc: dhcpcsvc ncalrpc: dhcpcsvc6 ncacn_ip_tcp: 104.168.219.130:49665 ncacn_np: \\HWC-HWP-4998980\pipe\eventlog ncalrpc: eventlog ncalrpc: LRPC-58e976ac4a70b4c675 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 version: v1.0 annotation: DHCP Client LRPC Endpoint provider: dhcpcsvc.dll ncalrpc: dhcpcsvc ncalrpc: dhcpcsvc6 ncacn_ip_tcp: 104.168.219.130:49665 ncacn_np: \\HWC-HWP-4998980\pipe\eventlog ncalrpc: eventlog ncalrpc: LRPC-58e976ac4a70b4c675 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 version: v1.0 annotation: DHCPv6 Client LRPC Endpoint provider: dhcpcsvc6.dll ncalrpc: dhcpcsvc6 ncacn_ip_tcp: 104.168.219.130:49665 ncacn_np: \\HWC-HWP-4998980\pipe\eventlog ncalrpc: eventlog ncalrpc: LRPC-58e976ac4a70b4c675 f6beaff7-1e19-4fbb-9f8f-b89e2018337c version: v1.0 annotation: Event log TCPIP protocol: [MS-EVEN6]: EventLog Remoting Protocol provider: wevtsvc.dll ncacn_ip_tcp: 104.168.219.130:49665 ncacn_np: \\HWC-HWP-4998980\pipe\eventlog ncalrpc: eventlog ncalrpc: LRPC-58e976ac4a70b4c675 30adc50c-5cbc-46ce-9a0e-91914789e23c version: v1.0 annotation: NRP server endpoint provider: nrpsrv.dll ncalrpc: LRPC-58e976ac4a70b4c675 bf4dc912-e52f-4904-8ebe-9317c1bdd497 version: v1.0 ncalrpc: LRPC-5d0288238dc1eda463 ncalrpc: trkwks ncacn_np: \\HWC-HWP-4998980\pipe\trkwks ncalrpc: LRPC-21fa0b6ceeaab33862 ncalrpc: TSUMRPD_PRINT_DRV_LPC_API ncalrpc: OLE3C3AE5BA2B597DFDD8E26BA6C43A ncalrpc: LRPC-0bfa8d3402ae4a270d ncalrpc: LRPC-c1507e07e36ee07c44 54b4c689-969a-476f-8dc2-990885e9f562 version: v0.0 ncalrpc: LRPC-21fa0b6ceeaab33862 ncalrpc: TSUMRPD_PRINT_DRV_LPC_API ncalrpc: OLE3C3AE5BA2B597DFDD8E26BA6C43A ncalrpc: LRPC-0bfa8d3402ae4a270d ncalrpc: LRPC-c1507e07e36ee07c44 be7f785e-0e3a-4ab7-91de-7e46e443be29 version: v0.0 ncalrpc: LRPC-21fa0b6ceeaab33862 ncalrpc: TSUMRPD_PRINT_DRV_LPC_API ncalrpc: OLE3C3AE5BA2B597DFDD8E26BA6C43A ncalrpc: LRPC-0bfa8d3402ae4a270d ncalrpc: LRPC-c1507e07e36ee07c44 0767a036-0d22-48aa-ba69-b619480f38cb version: v1.0 annotation: PcaSvc provider: pcasvc.dll ncalrpc: LRPC-21fa0b6ceeaab33862 ncalrpc: TSUMRPD_PRINT_DRV_LPC_API ncalrpc: OLE3C3AE5BA2B597DFDD8E26BA6C43A ncalrpc: LRPC-0bfa8d3402ae4a270d ncalrpc: LRPC-c1507e07e36ee07c44 e40f7b57-7a25-4cd3-a135-7f7d3df9d16b version: v1.0 annotation: Network Connection Broker server endpoint ncalrpc: LRPC-21fa0b6ceeaab33862 ncalrpc: TSUMRPD_PRINT_DRV_LPC_API ncalrpc: OLE3C3AE5BA2B597DFDD8E26BA6C43A ncalrpc: LRPC-0bfa8d3402ae4a270d ncalrpc: LRPC-c1507e07e36ee07c44 880fd55e-43b9-11e0-b1a8-cf4edfd72085 version: v1.0 annotation: KAPI Service endpoint ncalrpc: LRPC-21fa0b6ceeaab33862 ncalrpc: TSUMRPD_PRINT_DRV_LPC_API ncalrpc: OLE3C3AE5BA2B597DFDD8E26BA6C43A ncalrpc: LRPC-0bfa8d3402ae4a270d ncalrpc: LRPC-c1507e07e36ee07c44 5222821f-d5e2-4885-84f1-5f6185a0ec41 version: v1.0 annotation: Network Connection Broker server endpoint for NCB Reset module ncalrpc: LRPC-0bfa8d3402ae4a270d ncalrpc: LRPC-c1507e07e36ee07c44 2fb92682-6599-42dc-ae13-bd2ca89bd11c version: v1.0 annotation: Fw APIs provider: MPSSVC.dll ncalrpc: LRPC-0ca1b8fd984012715d ncalrpc: LRPC-218a83c47bca839e4e ncalrpc: LRPC-35a93fb6c04edc897b f47433c3-3e9d-4157-aad4-83aa1f5c2d4c version: v1.0 annotation: Fw APIs ncalrpc: LRPC-0ca1b8fd984012715d ncalrpc: LRPC-218a83c47bca839e4e ncalrpc: LRPC-35a93fb6c04edc897b 7f9d11bf-7fb9-436b-a812-b2d50c5d4c03 version: v1.0 annotation: Fw APIs provider: MPSSVC.dll ncalrpc: LRPC-0ca1b8fd984012715d ncalrpc: LRPC-218a83c47bca839e4e ncalrpc: LRPC-35a93fb6c04edc897b dd490425-5325-4565-b774-7e27d6c09c24 version: v1.0 annotation: Base Firewall Engine API provider: BFE.DLL ncalrpc: LRPC-218a83c47bca839e4e ncalrpc: LRPC-35a93fb6c04edc897b df4df73a-c52d-4e3a-8003-8437fdf8302a version: v0.0 annotation: WM_WindowManagerRPC\Server ncalrpc: LRPC-35a93fb6c04edc897b a4b8d482-80ce-40d6-934d-b22a01a44fe7 version: v1.0 annotation: LicenseManager ncalrpc: LicenseServiceEndpoint 3473dd4d-2e88-4006-9cba-22570909dd10 version: v5.256 annotation: WinHttp Auto-Proxy Service ncalrpc: SstpSvcRpc ncacn_np: \\HWC-HWP-4998980\PIPE\W32TIME_ALT ncalrpc: W32TIME_ALT ncalrpc: OLE62342729F7D2018B45046FBBA9BB ncalrpc: LRPC-a47133336e066ec2a5 7ea70bcf-48af-4f6a-8968-6a440754d5fa version: v1.0 annotation: NSI server endpoint provider: nsisvc.dll ncalrpc: LRPC-a47133336e066ec2a5 7aeb6705-3ae6-471a-882d-f39c109edc12 version: v1.0 ncalrpc: LRPC-c586c64b482f3bb221 e7f76134-9ef5-4949-a2d6-3368cc0988f3 version: v1.0 ncalrpc: LRPC-c586c64b482f3bb221 b3781086-6a54-489b-91c8-51d067172ab7 version: v1.0 ncalrpc: LRPC-c586c64b482f3bb221 b37f900a-eae4-4304-a2ab-12bb668c0188 version: v1.0 ncalrpc: LRPC-c586c64b482f3bb221 abfb6ca3-0c5e-4734-9285-0aee72fe8d1c version: v1.0 ncalrpc: LRPC-c586c64b482f3bb221 7f1343fe-50a9-4927-a778-0c5859517bac version: v1.0 annotation: DfsDs service ncacn_np: \\HWC-HWP-4998980\PIPE\wkssvc ncalrpc: nlaapi ncalrpc: DNSResolver ncalrpc: nlaplg eb081a0d-10ee-478a-a1dd-50995283e7a8 version: v3.0 annotation: Witness Client Test Interface ncalrpc: nlaapi ncalrpc: DNSResolver ncalrpc: nlaplg f2c9b409-c1c9-4100-8639-d8ab1486694a version: v1.0 annotation: Witness Client Upcall Server ncalrpc: nlaapi ncalrpc: DNSResolver ncalrpc: nlaplg 76f03f96-cdfd-44fc-a22c-64950a001209 version: v1.0 protocol: [MS-PAR]: Print System Asynchronous Remote Protocol provider: spoolsv.exe ncacn_ip_tcp: 104.168.219.130:49667 ncalrpc: LRPC-eef703d320cb247cf8 4a452661-8290-4b36-8fbe-7f4093a94978 version: v1.0 provider: spoolsv.exe ncacn_ip_tcp: 104.168.219.130:49667 ncalrpc: LRPC-eef703d320cb247cf8 ae33069b-a2a8-46ee-a235-ddfd339be281 version: v1.0 protocol: [MS-PAN]: Print System Asynchronous Notification Protocol provider: spoolsv.exe ncacn_ip_tcp: 104.168.219.130:49667 ncalrpc: LRPC-eef703d320cb247cf8 0b6edbfa-4a24-4fc6-8a23-942b1eca65d1 version: v1.0 protocol: [MS-PAN]: Print System Asynchronous Notification Protocol provider: spoolsv.exe ncacn_ip_tcp: 104.168.219.130:49667 ncalrpc: LRPC-eef703d320cb247cf8 12345678-1234-abcd-ef00-0123456789ab version: v1.0 protocol: [MS-RPRN]: Print System Remote Protocol provider: spoolsv.exe ncacn_ip_tcp: 104.168.219.130:49667 ncalrpc: LRPC-eef703d320cb247cf8 12345778-1234-abcd-ef00-0123456789ac version: v1.0 protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol provider: samsrv.dll ncacn_ip_tcp: 104.168.219.130:49676 ncalrpc: samss lpc ncalrpc: SidKey Local End Point ncalrpc: protected_storage ncalrpc: lsasspirpc ncalrpc: lsapolicylookup ncalrpc: LSA_EAS_ENDPOINT ncalrpc: LSA_IDPEXT_ENDPOINT ncalrpc: lsacap ncalrpc: LSARPC_ENDPOINT ncalrpc: securityevent ncalrpc: audit ncacn_np: \\HWC-HWP-4998980\pipe\lsass 51a227ae-825b-41f2-b4a9-1ac9557a1018 version: v1.0 annotation: Ngc Pop Key Service ncalrpc: samss lpc ncalrpc: SidKey Local End Point ncalrpc: protected_storage ncalrpc: lsasspirpc ncalrpc: lsapolicylookup ncalrpc: LSA_EAS_ENDPOINT ncalrpc: LSA_IDPEXT_ENDPOINT ncalrpc: lsacap ncalrpc: LSARPC_ENDPOINT ncalrpc: securityevent ncalrpc: audit ncacn_np: \\HWC-HWP-4998980\pipe\lsass 8fb74744-b2ff-4c00-be0d-9ef9a191fe1b version: v1.0 annotation: Ngc Pop Key Service ncalrpc: samss lpc ncalrpc: SidKey Local End Point ncalrpc: protected_storage ncalrpc: lsasspirpc ncalrpc: lsapolicylookup ncalrpc: LSA_EAS_ENDPOINT ncalrpc: LSA_IDPEXT_ENDPOINT ncalrpc: lsacap ncalrpc: LSARPC_ENDPOINT ncalrpc: securityevent ncalrpc: audit ncacn_np: \\HWC-HWP-4998980\pipe\lsass b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 version: v2.0 annotation: KeyIso ncalrpc: samss lpc ncalrpc: SidKey Local End Point ncalrpc: protected_storage ncalrpc: lsasspirpc ncalrpc: lsapolicylookup ncalrpc: LSA_EAS_ENDPOINT ncalrpc: LSA_IDPEXT_ENDPOINT ncalrpc: lsacap ncalrpc: LSARPC_ENDPOINT ncalrpc: securityevent ncalrpc: audit ncacn_np: \\HWC-HWP-4998980\pipe\lsass 1a0d010f-1c33-432c-b0f5-8cf4e8053099 version: v1.0 annotation: IdSegSrv service ncalrpc: LRPC-725930357db097f9f7 98716d03-89ac-44c7-bb8c-285824e51c4a version: v1.0 annotation: XactSrv service provider: srvsvc.dll ncalrpc: LRPC-725930357db097f9f7 367abb81-9844-35f1-ad32-98f038001003 version: v2.0 protocol: [MS-SCMR]: Service Control Manager Remote Protocol provider: services.exe ncacn_ip_tcp: 104.168.219.130:49675 906b0ce0-c70b-1067-b317-00dd010662da version: v1.0 protocol: [MS-CMPO]: MSDTC Connection Manager: provider: msdtcprx.dll ncalrpc: LRPC-76e9333107abc9263e ncalrpc: LRPC-76e9333107abc9263e ncalrpc: LRPC-76e9333107abc9263e 12e65dd8-887f-41ef-91bf-8d816c42c2e7 version: v1.0 annotation: Secure Desktop LRPC interface provider: winlogon.exe ncalrpc: WMsgKRpc024B4752 b1ef227e-dfa5-421e-82bb-67a6a129c496 version: v0.0 ncalrpc: LRPC-06bf3ae6056f88953b ncalrpc: OLEEFFEC7BE2B766DEFFE849C8CAFCF 0fc77b1a-95d8-4a2e-a0c0-cff54237462b version: v0.0 ncalrpc: LRPC-06bf3ae6056f88953b ncalrpc: OLEEFFEC7BE2B766DEFFE849C8CAFCF 8ec21e98-b5ce-4916-a3d6-449fa428a007 version: v0.0 ncalrpc: LRPC-06bf3ae6056f88953b ncalrpc: OLEEFFEC7BE2B766DEFFE849C8CAFCF 43890c94-bfd7-4655-ad6a-b4a68397cdcb version: v0.0 ncalrpc: LRPC-454d87f50e3e0c0c87 ncalrpc: OLEA9C9D6BC675526DC9BCFF16AA34A c8ba73d2-3d55-429c-8e9a-c44f006f69fc version: v0.0 ncalrpc: LRPC-454d87f50e3e0c0c87 ncalrpc: OLEA9C9D6BC675526DC9BCFF16AA34A e8748f69-a2a4-40df-9366-62dbeb696e26 version: v0.0 ncalrpc: LRPC-454d87f50e3e0c0c87 ncalrpc: OLEA9C9D6BC675526DC9BCFF16AA34A 923c9623-db7f-4b34-9e6d-e86580f8ca2a version: v1.0 ncalrpc: LRPC-454d87f50e3e0c0c87 ncalrpc: OLEA9C9D6BC675526DC9BCFF16AA34A 0c53aa2e-fb1c-49c5-bfb6-c54f8e5857cd version: v1.0 ncalrpc: LRPC-454d87f50e3e0c0c87 ncalrpc: OLEA9C9D6BC675526DC9BCFF16AA34A d2716e94-25cb-4820-bc15-537866578562 version: v1.0 ncalrpc: LRPC-454d87f50e3e0c0c87 ncalrpc: OLEA9C9D6BC675526DC9BCFF16AA34A 3a9ef155-691d-4449-8d05-09ad57031823 version: v1.0 ncacn_ip_tcp: 104.168.219.130:54634 ncalrpc: LRPC-dc482e60cf96bcd0d7 ncalrpc: ubpmtaskhostchannel ncacn_np: \\HWC-HWP-4998980\PIPE\atsvc ncalrpc: LRPC-11e4ba488fd6c6fe1e 86d35949-83c9-4044-b424-db363231fd0c version: v1.0 protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol provider: schedsvc.dll ncacn_ip_tcp: 104.168.219.130:54634 ncalrpc: LRPC-dc482e60cf96bcd0d7 ncalrpc: ubpmtaskhostchannel ncacn_np: \\HWC-HWP-4998980\PIPE\atsvc ncalrpc: LRPC-11e4ba488fd6c6fe1e 33d84484-3626-47ee-8c6f-e7e98b113be1 version: v2.0 ncalrpc: LRPC-dc482e60cf96bcd0d7 ncalrpc: ubpmtaskhostchannel ncacn_np: \\HWC-HWP-4998980\PIPE\atsvc ncalrpc: LRPC-11e4ba488fd6c6fe1e 378e52b0-c0a9-11cf-822d-00aa0051e40f version: v1.0 protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol provider: taskcomp.dll ncacn_np: \\HWC-HWP-4998980\PIPE\atsvc ncalrpc: LRPC-11e4ba488fd6c6fe1e 1ff70682-0a51-30e8-076d-740be8cee98b version: v1.0 protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol provider: taskcomp.dll ncacn_np: \\HWC-HWP-4998980\PIPE\atsvc ncalrpc: LRPC-11e4ba488fd6c6fe1e 0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 version: v1.0 provider: schedsvc.dll ncalrpc: LRPC-11e4ba488fd6c6fe1e a398e520-d59a-4bdd-aa7a-3c1e0303a511 version: v1.0 annotation: IKE/Authip API provider: IKEEXT.DLL ncalrpc: LRPC-d9b210946ec6243153 ncalrpc: VpnikeRpc ncalrpc: RasmanLrpc ncacn_np: \\HWC-HWP-4998980\PIPE\ROUTER ncalrpc: senssvc ncalrpc: LRPC-1280200b2f93aaecb7 ncacn_ip_tcp: 104.168.219.130:54635 ncacn_np: \\HWC-HWP-4998980\pipe\SessEnvPublicRpc ncalrpc: SessEnvPrivateRpc ncalrpc: LRPC-b94c0d491ce5706fc2 ncalrpc: LRPC-d9837a61b8beb6cafa ncalrpc: OLE4F9290003188FE93F90386E78694 ncalrpc: IUserProfile2 650a7e26-eab8-5533-ce43-9c1dfce11511 version: v1.0 annotation: Vpn APIs ncalrpc: LRPC-d9b210946ec6243153 ncalrpc: VpnikeRpc ncalrpc: RasmanLrpc ncacn_np: \\HWC-HWP-4998980\PIPE\ROUTER ncalrpc: senssvc ncalrpc: LRPC-1280200b2f93aaecb7 ncacn_ip_tcp: 104.168.219.130:54635 ncacn_np: \\HWC-HWP-4998980\pipe\SessEnvPublicRpc ncalrpc: SessEnvPrivateRpc ncalrpc: LRPC-b94c0d491ce5706fc2 ncalrpc: LRPC-d9837a61b8beb6cafa ncalrpc: OLE4F9290003188FE93F90386E78694 ncalrpc: IUserProfile2 c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1 version: v1.0 annotation: Adh APIs ncalrpc: RasmanLrpc ncacn_np: \\HWC-HWP-4998980\PIPE\ROUTER ncalrpc: senssvc ncalrpc: LRPC-1280200b2f93aaecb7 ncacn_ip_tcp: 104.168.219.130:54635 ncacn_np: \\HWC-HWP-4998980\pipe\SessEnvPublicRpc ncalrpc: SessEnvPrivateRpc ncalrpc: LRPC-b94c0d491ce5706fc2 ncalrpc: LRPC-d9837a61b8beb6cafa ncalrpc: OLE4F9290003188FE93F90386E78694 ncalrpc: IUserProfile2 c36be077-e14b-4fe9-8abc-e856ef4f048b version: v1.0 annotation: Proxy Manager client server endpoint ncalrpc: senssvc ncalrpc: LRPC-1280200b2f93aaecb7 ncacn_ip_tcp: 104.168.219.130:54635 ncacn_np: \\HWC-HWP-4998980\pipe\SessEnvPublicRpc ncalrpc: SessEnvPrivateRpc ncalrpc: LRPC-b94c0d491ce5706fc2 ncalrpc: LRPC-d9837a61b8beb6cafa ncalrpc: OLE4F9290003188FE93F90386E78694 ncalrpc: IUserProfile2 2e6035b2-e8f1-41a7-a044-656b439c4c34 version: v1.0 annotation: Proxy Manager provider server endpoint ncalrpc: senssvc ncalrpc: LRPC-1280200b2f93aaecb7 ncacn_ip_tcp: 104.168.219.130:54635 ncacn_np: \\HWC-HWP-4998980\pipe\SessEnvPublicRpc ncalrpc: SessEnvPrivateRpc ncalrpc: LRPC-b94c0d491ce5706fc2 ncalrpc: LRPC-d9837a61b8beb6cafa ncalrpc: OLE4F9290003188FE93F90386E78694 ncalrpc: IUserProfile2 2eb08e3e-639f-4fba-97b1-14f878961076 version: v1.0 annotation: Group Policy RPC Interface provider: gpsvc.dll ncalrpc: LRPC-fe72c6f8abf324835d 30b044a5-a225-43f0-b3a4-e060df91f9c1 version: v1.0 provider: certprop.dll ncalrpc: LRPC-1280200b2f93aaecb7 ncacn_ip_tcp: 104.168.219.130:54635 ncacn_np: \\HWC-HWP-4998980\pipe\SessEnvPublicRpc ncalrpc: SessEnvPrivateRpc ncalrpc: LRPC-b94c0d491ce5706fc2 ncalrpc: LRPC-d9837a61b8beb6cafa ncalrpc: OLE4F9290003188FE93F90386E78694 ncalrpc: IUserProfile2 552d076a-cb29-4e44-8b6a-d15e59e2c0af version: v1.0 annotation: IP Transition Configuration endpoint provider: iphlpsvc.dll ncacn_ip_tcp: 104.168.219.130:54635 ncacn_np: \\HWC-HWP-4998980\pipe\SessEnvPublicRpc ncalrpc: SessEnvPrivateRpc ncalrpc: LRPC-b94c0d491ce5706fc2 ncalrpc: LRPC-d9837a61b8beb6cafa ncalrpc: OLE4F9290003188FE93F90386E78694 ncalrpc: IUserProfile2 29770a8f-829b-4158-90a2-78cd488501f7 version: v1.0 ncacn_ip_tcp: 104.168.219.130:54635 ncacn_np: \\HWC-HWP-4998980\pipe\SessEnvPublicRpc ncalrpc: SessEnvPrivateRpc ncalrpc: LRPC-b94c0d491ce5706fc2 ncalrpc: LRPC-d9837a61b8beb6cafa ncalrpc: OLE4F9290003188FE93F90386E78694 ncalrpc: IUserProfile2 0d3c7f20-1c8d-4654-a1b3-51563b298bda version: v1.0 annotation: UserMgrCli ncalrpc: LRPC-d9837a61b8beb6cafa ncalrpc: OLE4F9290003188FE93F90386E78694 ncalrpc: IUserProfile2 b18fbab6-56f8-4702-84e0-41053293a869 version: v1.0 annotation: UserMgrCli ncalrpc: LRPC-d9837a61b8beb6cafa ncalrpc: OLE4F9290003188FE93F90386E78694 ncalrpc: IUserProfile2
-266965736 | 2024-04-17T07:52:32.375039443 / tcp
HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Strict-Transport-Security: max-age=2592000 X-Powered-By: ASP.NET Date: Wed, 17 Apr 2024 07:52:31 GMT Content-Length: 6393
Certificate: Data: Version: 3 (0x2) Serial Number: 04:02:6d:d3:5c:65:95:d8:bf:54:b4:96:19:4b:c2:b5:e7:17 Signature Algorithm: sha256WithRSAEncryption Issuer: C=US, O=Let's Encrypt, CN=R3 Validity Not Before: Jan 23 08:36:54 2024 GMT Not After : Apr 22 08:36:53 2024 GMT Subject: CN=erp.welbornconsult.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:8f:3a:a7:e2:31:6f:9e:58:3b:5e:10:48:be:d2: eb:a5:08:20:76:cd:63:18:15:46:3d:6e:46:77:bc: 0b:6b:6a:c2:31:f2:00:38:06:8a:22:d0:70:b3:ad: 70:ba:a3:86:81:69:6e:7f:9e:76:9e:26:06:79:1c: e4:0a:1e:63:f8:71:74:54:e3:41:5a:a4:17:3e:b8: 54:33:d9:00:20:05:95:62:03:f2:e3:35:fe:a5:1b: c8:ce:04:0d:db:e6:96:bd:76:41:98:52:61:1e:34: 6d:9a:c3:5d:e5:08:e9:6f:9a:a8:d9:68:6d:43:c2: d2:2a:8e:cb:19:f2:6c:ed:60:d4:84:ff:57:ec:b8: 8b:7a:b0:02:79:2f:01:6e:87:81:16:4c:fe:c3:00: 3e:7c:a7:8f:53:2b:cb:23:e2:5d:a6:71:8e:90:70: 21:30:46:70:d7:0b:39:47:53:aa:45:45:6b:6f:4f: 64:53:7f:da:6e:69:34:c3:93:24:80:35:4e:9b:eb: 27:09:7f:d8:a0:a7:43:2d:85:71:4b:d3:72:07:8b: c1:ef:d5:70:48:22:4f:08:65:2f:c2:c9:ca:e0:03: ea:df:25:1f:43:e8:75:9c:fc:34:45:eb:81:35:54: 57:0f:e8:99:74:4c:16:d3:d2:a7:64:81:4f:a0:b1: 84:f7 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Basic Constraints: critical CA:FALSE X509v3 Subject Key Identifier: DD:E9:C4:64:17:FA:68:5E:83:7E:DB:66:66:F5:C8:1A:6A:4B:31:52 X509v3 Authority Key Identifier: 14:2E:B3:17:B7:58:56:CB:AE:50:09:40:E6:1F:AF:9D:8B:14:C2:C6 Authority Information Access: OCSP - URI:http://r3.o.lencr.org CA Issuers - URI:http://r3.i.lencr.org/ X509v3 Subject Alternative Name: DNS:erp.welbornconsult.com, DNS:erpdemo.welbornconsult.com X509v3 Certificate Policies: Policy: 2.23.140.1.2.1 CT Precertificate SCTs: Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 3B:53:77:75:3E:2D:B9:80:4E:8B:30:5B:06:FE:40:3B: 67:D8:4F:C3:F4:C7:BD:00:0D:2D:72:6F:E1:FA:D4:17 Timestamp : Jan 23 09:36:54.934 2024 GMT Extensions: none Signature : ecdsa-with-SHA256 30:46:02:21:00:A9:8C:B3:D8:9D:65:FC:40:4A:67:EA: 80:00:18:4C:9C:1A:06:08:D1:17:FC:11:FC:6E:FF:55: 52:ED:A3:0F:05:02:21:00:CE:D1:DE:96:1F:4E:80:30: EE:AD:F1:F2:F9:70:2D:DF:25:FA:34:7A:80:1F:73:BB: 6C:D8:5C:BA:C4:0D:B3:6E Signed Certificate Timestamp: Version : v1 (0x0) Log ID : 48:B0:E3:6B:DA:A6:47:34:0F:E5:6A:02:FA:9D:30:EB: 1C:52:01:CB:56:DD:2C:81:D9:BB:BF:AB:39:D8:84:73 Timestamp : Jan 23 09:36:54.944 2024 GMT Extensions: none Signature : ecdsa-with-SHA256 30:45:02:21:00:CA:7A:95:CA:5A:A1:02:DC:32:2E:42: DE:54:57:0C:96:13:A9:EE:03:7B:8E:82:8D:88:C0:A9: B1:02:67:EC:81:02:20:60:90:7D:A4:DD:29:7E:5F:C2: 38:A5:19:8C:5B:81:7B:D6:7B:0A:88:FF:FD:14:B1:87: 4D:EB:68:F1:84:CB:38 Signature Algorithm: sha256WithRSAEncryption Signature Value: 71:d7:e8:9b:20:4a:4f:c1:59:ed:fa:c3:82:6f:bf:81:64:c2: f8:84:ec:78:91:52:88:d5:b0:b5:22:b7:8e:b1:df:51:21:47: 77:63:ad:d6:31:bd:06:e0:90:2a:b4:4b:b9:30:6e:e9:73:df: 2f:4a:c4:82:6c:2e:5b:6b:de:65:f6:cb:2c:ac:bd:ca:14:a0: 8f:0d:d1:2c:8e:f7:28:ee:c1:5a:3d:96:80:90:ad:db:ba:cc: 4c:f8:42:4f:2a:b4:66:39:4e:53:15:6d:4b:9f:bb:7b:51:86: 6f:f3:b7:4c:95:d1:c7:9d:6e:81:c3:ce:5c:67:de:5b:2e:13: 65:44:bb:4e:21:bd:41:01:98:c3:ae:94:76:a9:ca:9c:ba:dd: 68:9a:f6:97:74:e3:ae:6b:d1:fa:17:27:e8:44:52:75:ec:7a: 4d:5e:3b:2d:d2:1f:24:0b:fb:96:ad:ef:35:e7:12:60:0b:fb: d5:be:a6:20:40:f2:52:53:0e:b3:e9:3f:92:b7:0f:7f:98:e0: 79:62:07:d6:07:4b:4a:21:26:a5:39:ba:e5:9c:7e:23:ff:50: eb:f3:05:95:81:64:0a:c5:92:74:52:73:c3:97:4a:18:00:59: e0:83:2c:c4:9e:f5:5c:20:d3:3e:b3:66:96:8c:85:01:be:64: 54:a0:ff:73
-1166656618 | 2024-04-21T12:04:20.113623445 / tcp
SMB Status: Authentication: enabled SMB Version: 2 Capabilities: raw-mode
-1153812797 | 2024-04-19T04:19:47.5510293389 / tcp
Remote Desktop Protocol \x03\x00\x00\x13\x0e\xd0\x00\x00\x124\x00\x02\x1f\x08\x00\x02\x00\x00\x00 Remote Desktop Protocol NTLM Info: OS: Windows 10 (version 1607)/Windows Server 2016 (version 1607) OS Build: 10.0.14393 Target Name: HWC-HWP-4998980 NetBIOS Domain Name: HWC-HWP-4998980 NetBIOS Computer Name: HWC-HWP-4998980 DNS Domain Name: hwc-hwp-4998980 FQDN: hwc-hwp-4998980
Certificate: Data: Version: 3 (0x2) Serial Number: 23:2a:a9:ba:2a:fb:69:b0:43:72:33:2c:be:e0:fc:0a Signature Algorithm: sha256WithRSAEncryption Issuer: CN=hwc-hwp-4998980 Validity Not Before: Dec 21 08:23:28 2023 GMT Not After : Jun 21 08:23:28 2024 GMT Subject: CN=hwc-hwp-4998980 Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:ba:11:9e:3a:56:b0:48:b7:82:03:bf:94:83:89: 14:29:20:b6:19:b6:3e:ee:9e:e6:b4:20:7d:ca:41: c1:fd:b0:7a:cd:ac:89:67:76:c6:bd:d0:de:bf:63: 0b:44:00:db:27:0d:4f:21:05:52:2a:9e:13:ca:dd: fe:47:be:4e:bc:9f:df:7d:ab:8b:77:98:5f:6b:51: 56:1a:31:82:40:79:df:7a:5e:61:1a:4c:72:83:88: e5:cb:f5:c9:fe:a9:2b:b7:21:cb:f7:4f:71:9f:bc: 6b:46:4d:9c:b2:7e:05:bc:ce:68:95:3f:da:86:d7: c4:07:a8:8c:67:e6:7c:1a:24:16:dd:05:43:db:cf: a8:3b:ba:a4:b5:30:b1:62:a6:8d:6e:da:e0:71:eb: c2:10:41:4d:1e:8e:5a:68:62:34:c7:bb:ff:c1:90: b3:d3:a3:ac:b0:b6:54:92:a6:c2:e6:52:0d:d0:32: 56:c5:e3:dd:07:18:72:f2:f6:4a:10:82:2f:da:54: c3:40:08:17:c8:8e:2a:d5:71:59:ae:98:c6:4b:e8: 79:c8:82:79:be:37:c5:56:12:87:2c:0f:cd:b7:d0: 54:be:a0:fd:d1:f7:d2:a4:57:ad:1a:8a:98:0e:ef: f3:63:6f:46:3b:0e:9d:1b:91:87:c6:d9:54:d3:51: ae:8d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 Key Usage: Key Encipherment, Data Encipherment Signature Algorithm: sha256WithRSAEncryption Signature Value: 6b:1e:14:15:1f:76:5a:18:c7:3c:5a:b7:a9:75:b9:d6:82:5e: 26:a7:d9:a4:fc:c8:1f:d5:50:cc:bf:fb:38:11:07:f1:f5:f9: 99:68:50:eb:63:60:d0:8b:84:71:d4:61:07:29:0d:2e:2f:2c: 51:5d:14:a9:55:62:fa:69:87:23:e9:1d:40:f9:38:1b:05:17: b7:46:1a:bf:47:cb:2d:70:3b:cf:8a:1b:66:ff:11:0a:40:06: 1d:dd:80:74:45:af:eb:c9:0c:09:64:f0:97:2b:cd:8b:b6:19: 35:12:56:a7:88:a8:a1:cd:f7:20:d2:42:5a:9f:c7:3e:af:e0: 51:0f:2d:86:d6:84:b5:bc:bc:e5:5b:0f:10:0d:28:61:8d:4e: b1:08:b7:74:f2:f6:a8:c5:9e:ce:c4:5b:f9:f0:f0:30:de:db: 60:25:dd:a4:c8:e9:30:18:9c:3f:aa:b5:87:53:e2:b1:51:35: cd:9c:ab:6f:b2:a4:c4:b8:de:b7:33:b1:c2:e0:b5:2b:58:c0: 0c:f5:ab:a2:6c:79:16:58:57:cb:91:7c:a3:7b:cb:f4:be:17: 9a:11:dc:d7:80:a9:f2:92:ec:cf:4b:d0:ba:d8:82:33:44:46: e7:8b:13:76:ca:d9:3d:71:42:d1:fe:e5:98:9e:bd:31:a0:a2: ba:f0:f9:74
1489525118 | 2024-04-10T13:58:47.5954905985 / tcp
HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Wed, 10 Apr 2024 13:58:47 GMT Connection: close Content-Length: 315 WinRM NTLM Info: OS: Windows Server 2016 (version 1607) OS Build: 10.0.14393 Target Name: HWC-HWP-4998980 NetBIOS Domain Name: HWC-HWP-4998980 NetBIOS Computer Name: HWC-HWP-4998980 DNS Domain Name: hwc-hwp-4998980 FQDN: hwc-hwp-4998980