1186869136 | 2024-04-11T13:40:19.109379
135 /
tcp
Microsoft RPC Endpoint Mapper
12345778-1234-abcd-ef00-0123456789ac
version: v1.0
protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol
provider: samsrv.dll
ncacn_ip_tcp: 172.18.149.112:49164
ncalrpc: samss lpc
ncalrpc: dsrole
ncacn_np: \\iZbk4xv87fsfjfZ\PIPE\protected_storage
ncalrpc: protected_storage
ncalrpc: securityevent
ncalrpc: audit
ncalrpc: LRPC-99eff73f6fc9ef4661
ncacn_np: \\iZbk4xv87fsfjfZ\pipe\lsass
c9ac6db5-82b7-4e55-ae8a-e464ed7b4277
version: v1.0
annotation: Impl friendly name
provider: sysntfy.dll
ncalrpc: samss lpc
ncalrpc: dsrole
ncacn_np: \\iZbk4xv87fsfjfZ\PIPE\protected_storage
ncalrpc: protected_storage
ncalrpc: securityevent
ncalrpc: audit
ncalrpc: LRPC-99eff73f6fc9ef4661
ncacn_np: \\iZbk4xv87fsfjfZ\pipe\lsass
ncalrpc: LRPC-296059fc90fa23008c
ncacn_np: \\iZbk4xv87fsfjfZ\PIPE\srvsvc
ncalrpc: SECLOGON
ncacn_ip_tcp: 172.18.149.112:49154
ncacn_np: \\iZbk4xv87fsfjfZ\PIPE\atsvc
ncalrpc: OLEC1FF572426FB45329E44A00E2961
ncalrpc: senssvc
ncalrpc: IUserProfile2
ncalrpc: senssvc
ncalrpc: IUserProfile2
ncalrpc: IUserProfile2
ncalrpc: LRPC-116d425bf213d9be6b
d95afe70-a6d5-4259-822e-2c84da1ddb0d
version: v1.0
protocol: [MS-RSP]: Remote Shutdown Protocol
provider: wininit.exe
ncacn_ip_tcp: 172.18.149.112:49152
ncalrpc: WindowsShutdown
ncacn_np: \\iZbk4xv87fsfjfZ\PIPE\InitShutdown
ncalrpc: WMsgKRpc08BDF0
76f226c3-ec14-4325-8a99-6a46348418af
version: v1.0
provider: winlogon.exe
ncalrpc: WindowsShutdown
ncacn_np: \\iZbk4xv87fsfjfZ\PIPE\InitShutdown
ncalrpc: WMsgKRpc08BDF0
ncalrpc: WMsgKRpc090B01
ncalrpc: WMsgKRpc0250A0F2
3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6
version: v1.0
annotation: DHCPv6 Client LRPC Endpoint
provider: dhcpcsvc6.dll
ncalrpc: dhcpcsvc6
ncalrpc: dhcpcsvc
ncacn_ip_tcp: 172.18.149.112:49153
ncacn_np: \\iZbk4xv87fsfjfZ\pipe\eventlog
ncalrpc: eventlog
3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5
version: v1.0
annotation: DHCP Client LRPC Endpoint
provider: dhcpcsvc.dll
ncalrpc: dhcpcsvc
ncacn_ip_tcp: 172.18.149.112:49153
ncacn_np: \\iZbk4xv87fsfjfZ\pipe\eventlog
ncalrpc: eventlog
f6beaff7-1e19-4fbb-9f8f-b89e2018337c
version: v1.0
annotation: Event log TCPIP
protocol: [MS-EVEN6]: EventLog Remoting Protocol
provider: wevtsvc.dll
ncacn_ip_tcp: 172.18.149.112:49153
ncacn_np: \\iZbk4xv87fsfjfZ\pipe\eventlog
ncalrpc: eventlog
30b044a5-a225-43f0-b3a4-e060df91f9c1
version: v1.0
provider: certprop.dll
ncacn_np: \\iZbk4xv87fsfjfZ\PIPE\srvsvc
ncalrpc: SECLOGON
ncacn_ip_tcp: 172.18.149.112:49154
ncacn_np: \\iZbk4xv87fsfjfZ\PIPE\atsvc
ncalrpc: OLEC1FF572426FB45329E44A00E2961
ncalrpc: senssvc
ncalrpc: IUserProfile2
a398e520-d59a-4bdd-aa7a-3c1e0303a511
version: v1.0
annotation: IKE/Authip API
provider: IKEEXT.DLL
ncacn_ip_tcp: 172.18.149.112:49154
ncacn_np: \\iZbk4xv87fsfjfZ\PIPE\atsvc
ncalrpc: OLEC1FF572426FB45329E44A00E2961
ncalrpc: senssvc
ncalrpc: IUserProfile2
86d35949-83c9-4044-b424-db363231fd0c
version: v1.0
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: schedsvc.dll
ncacn_ip_tcp: 172.18.149.112:49154
ncacn_np: \\iZbk4xv87fsfjfZ\PIPE\atsvc
ncalrpc: OLEC1FF572426FB45329E44A00E2961
ncalrpc: senssvc
ncalrpc: IUserProfile2
378e52b0-c0a9-11cf-822d-00aa0051e40f
version: v1.0
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: taskcomp.dll
ncacn_np: \\iZbk4xv87fsfjfZ\PIPE\atsvc
ncalrpc: OLEC1FF572426FB45329E44A00E2961
ncalrpc: senssvc
ncalrpc: IUserProfile2
1ff70682-0a51-30e8-076d-740be8cee98b
version: v1.0
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: taskcomp.dll
ncacn_np: \\iZbk4xv87fsfjfZ\PIPE\atsvc
ncalrpc: OLEC1FF572426FB45329E44A00E2961
ncalrpc: senssvc
ncalrpc: IUserProfile2
0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53
version: v1.0
provider: schedsvc.dll
ncalrpc: OLEC1FF572426FB45329E44A00E2961
ncalrpc: senssvc
ncalrpc: IUserProfile2
2eb08e3e-639f-4fba-97b1-14f878961076
version: v1.0
provider: gpsvc.dll
ncalrpc: LRPC-116d425bf213d9be6b
24019106-a203-4642-b88d-82dae9158929
version: v1.0
provider: authui.dll
ncalrpc: LRPC-28720a013de08caef1
3473dd4d-2e88-4006-9cba-22570909dd10
version: v5.256
annotation: WinHttp Auto-Proxy Service
ncacn_np: \\iZbk4xv87fsfjfZ\PIPE\W32TIME_ALT
ncalrpc: W32TIME_ALT
ncacn_np: \\iZbk4xv87fsfjfZ\PIPE\wkssvc
ncalrpc: LRPC-fc6e322e657433f848
ncalrpc: OLE576E0D0058EF41C383166AC61304
7ea70bcf-48af-4f6a-8968-6a440754d5fa
version: v1.0
annotation: NSI server endpoint
provider: nsisvc.dll
ncalrpc: LRPC-fc6e322e657433f848
ncalrpc: OLE576E0D0058EF41C383166AC61304
2fb92682-6599-42dc-ae13-bd2ca89bd11c
version: v1.0
annotation: Fw APIs
provider: MPSSVC.dll
ncalrpc: LRPC-6776c6e5f37993e566
7f9d11bf-7fb9-436b-a812-b2d50c5d4c03
version: v1.0
annotation: Fw APIs
provider: MPSSVC.dll
ncalrpc: LRPC-6776c6e5f37993e566
dd490425-5325-4565-b774-7e27d6c09c24
version: v1.0
annotation: Base Firewall Engine API
provider: BFE.DLL
ncalrpc: LRPC-6776c6e5f37993e566
4a452661-8290-4b36-8fbe-7f4093a94978
version: v1.0
annotation: Spooler function endpoint
provider: spoolsv.exe
ncalrpc: spoolss
ae33069b-a2a8-46ee-a235-ddfd339be281
version: v1.0
annotation: Spooler base remote object endpoint
protocol: [MS-PAN]: Print System Asynchronous Notification Protocol
provider: spoolsv.exe
ncalrpc: spoolss
0b6edbfa-4a24-4fc6-8a23-942b1eca65d1
version: v1.0
annotation: Spooler function endpoint
protocol: [MS-PAN]: Print System Asynchronous Notification Protocol
provider: spoolsv.exe
ncalrpc: spoolss
12345678-1234-abcd-ef00-0123456789ab
version: v1.0
annotation: IPSec Policy agent endpoint
protocol: [MS-RPRN]: Print System Remote Protocol
provider: spoolsv.exe
ncalrpc: LRPC-819c3cea0136f0150d
ncacn_ip_tcp: 172.18.149.112:49160
6b5bdd1e-528c-422c-af8c-a4079be4fe48
version: v1.0
annotation: Remote Fw APIs
protocol: [MS-FASP]: Firewall and Advanced Security Protocol
provider: FwRemoteSvr.dll
ncacn_ip_tcp: 172.18.149.112:49160
367abb81-9844-35f1-ad32-98f038001003
version: v2.0
protocol: [MS-SCMR]: Service Control Manager Remote Protocol
provider: services.exe
ncacn_ip_tcp: 172.18.149.112:49163
906b0ce0-c70b-1067-b317-00dd010662da
version: v1.0
protocol: [MS-CMPO]: MSDTC Connection Manager:
provider: msdtcprx.dll
ncalrpc: LRPC-35d1d4999e6c84477f
ncalrpc: LRPC-35d1d4999e6c84477f
ncalrpc: LRPC-35d1d4999e6c84477f
ncalrpc: LRPC-35d1d4999e6c84477f
12e65dd8-887f-41ef-91bf-8d816c42c2e7
version: v1.0
annotation: Secure Desktop LRPC interface
provider: winlogon.exe
ncalrpc: WMsgKRpc0250A0F2
837657290 | 2024-04-14T01:24:48.303017
3389 /
tcp
Remote Desktop Protocol
\x03\x00\x00\x13\x0e\xd0\x00\x00\x124\x00\x02\x00\x08\x00\x02\x00\x00\x00
SSL Certificate
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
3d:8f:11:a6:3c:34:47:82:4c:ae:bd:34:da:b8:ba:1b
Signature Algorithm: sha1WithRSAEncryption
Issuer: CN=iZbk4xv87fsfjfZ
Validity
Not Before: Mar 11 10:24:45 2024 GMT
Not After : Sep 10 10:24:45 2024 GMT
Subject: CN=iZbk4xv87fsfjfZ
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:ab:79:e2:2d:56:0d:55:92:16:01:59:b7:5c:98:
96:69:95:53:c9:a7:fb:f7:2b:80:b7:1b:87:59:c7:
ed:1f:fe:89:e8:a0:db:63:55:c4:07:73:44:d0:f6:
62:9d:51:a7:36:f8:73:bb:86:58:1e:5c:0a:da:9d:
c4:0e:8a:fc:7d:c1:ad:3d:14:94:5b:97:ab:93:cd:
1c:c6:a0:e2:07:9b:f4:8b:af:00:35:13:90:32:5f:
60:15:af:0f:29:f2:6b:c4:8c:9b:41:10:6b:f4:9a:
32:e8:37:a8:d2:4f:6d:db:17:2f:c2:83:14:46:6a:
c0:a8:78:89:e8:31:fd:df:04:27:2b:a1:42:80:b9:
fa:40:3b:ef:29:8f:be:89:7a:d6:56:65:18:13:df:
f5:fd:8e:99:a5:4c:33:59:e1:dc:6d:24:05:1c:01:
eb:9e:ed:a1:96:53:e5:a7:23:59:88:f9:03:fc:03:
4b:5e:c4:7f:94:f4:f6:01:b2:26:51:49:4e:20:d4:
5e:e5:1e:6a:eb:8e:c4:1a:2c:33:5f:30:73:d4:6c:
bc:ee:c2:56:a2:05:d2:af:b8:7a:5d:8c:d6:d8:68:
2b:b2:29:3a:29:9b:6a:7c:3e:37:28:15:0e:56:80:
b4:9d:f4:3d:bd:44:cd:f5:65:52:01:ea:ef:b9:af:
b8:a5
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Key Usage:
Key Encipherment, Data Encipherment
Signature Algorithm: sha1WithRSAEncryption
Signature Value:
a1:04:be:08:db:dc:6e:bc:ce:c2:79:29:a8:02:77:89:e0:62:
e5:2f:e2:c8:e1:8d:e0:3e:c8:6b:3f:c2:3c:ed:47:4a:f7:46:
6e:0c:72:f7:85:bb:dc:a4:5d:bc:32:11:08:65:fd:bf:81:3b:
82:16:69:9b:e0:4c:ee:07:47:af:9e:08:bb:0e:e4:03:c0:29:
f5:80:52:4d:f9:17:04:ad:ff:33:d0:b9:8c:85:52:3e:b9:41:
3f:43:44:2f:67:8f:62:4b:a9:ca:1b:47:70:83:2a:13:26:4c:
c6:74:50:15:34:4c:33:a9:51:76:58:72:50:f6:f0:2e:f3:6a:
41:e0:c4:f0:e2:ee:d7:8a:87:2e:8b:1f:a2:d4:8c:8c:cd:1e:
21:a0:45:10:e8:01:15:1f:0e:07:56:6b:e9:0f:fd:4e:20:96:
55:9f:55:f3:e5:1e:a8:9e:9b:8a:b9:7e:0f:8a:ab:a4:22:bb:
96:1c:7c:c7:05:2d:56:22:db:82:3d:94:9f:e9:69:ab:5a:6c:
e4:ac:55:fe:30:76:74:d4:49:15:5e:49:5f:5f:29:c8:9b:d7:
5e:96:d0:fc:e6:27:dd:e4:29:88:e4:be:da:0f:25:ab:a0:6d:
64:7e:f4:d4:b7:32:fc:1b:5a:69:34:1f:3a:80:ab:80:33:5f:
8a:51:a3:e9
