-972859027 | 2024-09-11T19:10:00.902938
135 /
tcp
Microsoft RPC Endpoint Mapper
d95afe70-a6d5-4259-822e-2c84da1ddb0d
version: v1.0
protocol: [MS-RSP]: Remote Shutdown Protocol
provider: wininit.exe
ncacn_ip_tcp: 210.242.49.110:1025
ncalrpc: WindowsShutdown
ncacn_np: \\SERVER\PIPE\InitShutdown
ncalrpc: WMsgKRpc09C660
76f226c3-ec14-4325-8a99-6a46348418af
version: v1.0
provider: winlogon.exe
ncalrpc: WindowsShutdown
ncacn_np: \\SERVER\PIPE\InitShutdown
ncalrpc: WMsgKRpc09C660
ncalrpc: WMsgKRpc09C891
c9ac6db5-82b7-4e55-ae8a-e464ed7b4277
version: v1.0
annotation: Impl friendly name
provider: sysntfy.dll
ncalrpc: LRPC-bc875929ae6dd82e54
ncacn_np: \\SERVER\PIPE\srvsvc
ncacn_ip_tcp: 210.242.49.110:1028
ncacn_np: \\SERVER\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
ncalrpc: IUserProfile2
ncalrpc: senssvc
ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
ncalrpc: IUserProfile2
ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
ncalrpc: IUserProfile2
ncalrpc: IUserProfile2
ncalrpc: LRPC-5d4ac7c86699b7aa1d
12e65dd8-887f-41ef-91bf-8d816c42c2e7
version: v1.0
annotation: Secure Desktop LRPC interface
provider: winlogon.exe
ncalrpc: WMsgKRpc09C891
b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86
version: v1.0
annotation: KeyIso
provider: keyiso.dll
ncacn_ip_tcp: 210.242.49.110:1026
ncalrpc: samss lpc
ncalrpc: dsrole
ncacn_np: \\SERVER\PIPE\protected_storage
ncalrpc: protected_storage
ncalrpc: lsasspirpc
ncalrpc: lsapolicylookup
ncalrpc: LSARPC_ENDPOINT
ncalrpc: securityevent
ncalrpc: audit
ncalrpc: LRPC-e07368fd7c6cc585f1
ncacn_np: \\SERVER\pipe\lsass
12345778-1234-abcd-ef00-0123456789ac
version: v1.0
protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol
provider: samsrv.dll
ncacn_ip_tcp: 210.242.49.110:1026
ncalrpc: samss lpc
ncalrpc: dsrole
ncacn_np: \\SERVER\PIPE\protected_storage
ncalrpc: protected_storage
ncalrpc: lsasspirpc
ncalrpc: lsapolicylookup
ncalrpc: LSARPC_ENDPOINT
ncalrpc: securityevent
ncalrpc: audit
ncalrpc: LRPC-e07368fd7c6cc585f1
ncacn_np: \\SERVER\pipe\lsass
30adc50c-5cbc-46ce-9a0e-91914789e23c
version: v1.0
annotation: NRP server endpoint
provider: nrpsrv.dll
ncalrpc: dhcpcsvc
ncalrpc: dhcpcsvc6
ncacn_ip_tcp: 210.242.49.110:1027
ncacn_np: \\SERVER\pipe\eventlog
ncalrpc: eventlog
3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5
version: v1.0
annotation: DHCP Client LRPC Endpoint
provider: dhcpcsvc.dll
ncalrpc: dhcpcsvc
ncalrpc: dhcpcsvc6
ncacn_ip_tcp: 210.242.49.110:1027
ncacn_np: \\SERVER\pipe\eventlog
ncalrpc: eventlog
3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6
version: v1.0
annotation: DHCPv6 Client LRPC Endpoint
provider: dhcpcsvc6.dll
ncalrpc: dhcpcsvc6
ncacn_ip_tcp: 210.242.49.110:1027
ncacn_np: \\SERVER\pipe\eventlog
ncalrpc: eventlog
f6beaff7-1e19-4fbb-9f8f-b89e2018337c
version: v1.0
annotation: Event log TCPIP
protocol: [MS-EVEN6]: EventLog Remoting Protocol
provider: wevtsvc.dll
ncacn_ip_tcp: 210.242.49.110:1027
ncacn_np: \\SERVER\pipe\eventlog
ncalrpc: eventlog
98716d03-89ac-44c7-bb8c-285824e51c4a
version: v1.0
annotation: XactSrv service
provider: srvsvc.dll
ncacn_ip_tcp: 210.242.49.110:1028
ncacn_np: \\SERVER\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
ncalrpc: IUserProfile2
552d076a-cb29-4e44-8b6a-d15e59e2c0af
version: v1.0
annotation: IP Transition Configuration endpoint
provider: iphlpsvc.dll
ncacn_ip_tcp: 210.242.49.110:1028
ncacn_np: \\SERVER\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
ncalrpc: IUserProfile2
a398e520-d59a-4bdd-aa7a-3c1e0303a511
version: v1.0
annotation: IKE/Authip API
provider: IKEEXT.DLL
ncacn_ip_tcp: 210.242.49.110:1028
ncacn_np: \\SERVER\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
ncalrpc: IUserProfile2
86d35949-83c9-4044-b424-db363231fd0c
version: v1.0
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: schedsvc.dll
ncacn_ip_tcp: 210.242.49.110:1028
ncacn_np: \\SERVER\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
ncalrpc: IUserProfile2
378e52b0-c0a9-11cf-822d-00aa0051e40f
version: v1.0
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: taskcomp.dll
ncacn_np: \\SERVER\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
ncalrpc: IUserProfile2
1ff70682-0a51-30e8-076d-740be8cee98b
version: v1.0
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: taskcomp.dll
ncacn_np: \\SERVER\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
ncalrpc: IUserProfile2
0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53
version: v1.0
provider: schedsvc.dll
ncalrpc: senssvc
ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
ncalrpc: IUserProfile2
2eb08e3e-639f-4fba-97b1-14f878961076
version: v1.0
provider: gpsvc.dll
ncalrpc: OLE707550FC9CB84B65B290F5D2A47C
ncalrpc: IUserProfile2
3473dd4d-2e88-4006-9cba-22570909dd10
version: v5.256
annotation: WinHttp Auto-Proxy Service
ncacn_np: \\SERVER\PIPE\W32TIME_ALT
ncalrpc: W32TIME_ALT
ncalrpc: LRPC-830d0e65374fbf26e4
ncalrpc: OLEDDEAEE88AC574E72867C4BDAF8AD
7ea70bcf-48af-4f6a-8968-6a440754d5fa
version: v1.0
annotation: NSI server endpoint
provider: nsisvc.dll
ncalrpc: LRPC-830d0e65374fbf26e4
ncalrpc: OLEDDEAEE88AC574E72867C4BDAF8AD
266f33b4-c7c1-4bd1-8f52-ddb8f2214ea9
version: v1.0
annotation: Wlan Service
provider: wlansvc.dll
ncalrpc: LRPC-5d4ac7c86699b7aa1d
25952c5d-7976-4aa1-a3cb-c35f7ae79d1b
version: v1.256
annotation: Wireless Diagnostics
ncalrpc: LRPC-5d4ac7c86699b7aa1d
2fb92682-6599-42dc-ae13-bd2ca89bd11c
version: v1.0
annotation: Fw APIs
provider: MPSSVC.dll
ncalrpc: LRPC-26a42d32b8ec87b4e8
7f9d11bf-7fb9-436b-a812-b2d50c5d4c03
version: v1.0
annotation: Fw APIs
provider: MPSSVC.dll
ncalrpc: LRPC-26a42d32b8ec87b4e8
dd490425-5325-4565-b774-7e27d6c09c24
version: v1.0
annotation: Base Firewall Engine API
provider: BFE.DLL
ncalrpc: LRPC-26a42d32b8ec87b4e8
7f1343fe-50a9-4927-a778-0c5859517bac
version: v1.0
annotation: DfsDs service
ncacn_np: \\SERVER\PIPE\wkssvc
ncalrpc: DNSResolver
4a452661-8290-4b36-8fbe-7f4093a94978
version: v1.0
annotation: Spooler function endpoint
provider: spoolsv.exe
ncalrpc: spoolss
ae33069b-a2a8-46ee-a235-ddfd339be281
version: v1.0
annotation: Spooler base remote object endpoint
protocol: [MS-PAN]: Print System Asynchronous Notification Protocol
provider: spoolsv.exe
ncalrpc: spoolss
0b6edbfa-4a24-4fc6-8a23-942b1eca65d1
version: v1.0
annotation: Spooler function endpoint
protocol: [MS-PAN]: Print System Asynchronous Notification Protocol
provider: spoolsv.exe
ncalrpc: spoolss
1a9134dd-7b39-45ba-ad88-44d01ca47f28
version: v1.0
annotation: Message Queuing - RemoteRead V1
protocol: [MS-MQRR]: Message Queuing (MSMQ):
provider: mqqm.dll
ncacn_ip_tcp: 210.242.49.110:2105
ncacn_ip_tcp: 210.242.49.110:2103
ncacn_ip_tcp: 210.242.49.110:2107
ncacn_ip_tcp: 210.242.49.110:1029
ncalrpc: QMMgmtFacility$server
ncalrpc: QMsvc$server
1088a980-eae5-11d0-8d9b-00a02453c337
version: v1.0
annotation: Message Queuing - QM2QM V1
protocol: [MS-MQQP]: Message Queuing (MSMQ):
provider: mqqm.dll
ncacn_ip_tcp: 210.242.49.110:2105
ncacn_ip_tcp: 210.242.49.110:2103
ncacn_ip_tcp: 210.242.49.110:2107
ncacn_ip_tcp: 210.242.49.110:1029
ncalrpc: QMMgmtFacility$server
ncalrpc: QMsvc$server
76d12b80-3467-11d3-91ff-0090272f9ea3
version: v1.0
annotation: Message Queuing - QMRT V2
protocol: [MS-MQMP]: Message Queuing (MSMQ):
provider: mqqm.dll
ncacn_ip_tcp: 210.242.49.110:2105
ncacn_ip_tcp: 210.242.49.110:2103
ncacn_ip_tcp: 210.242.49.110:2107
ncacn_ip_tcp: 210.242.49.110:1029
ncalrpc: QMMgmtFacility$server
ncalrpc: QMsvc$server
fdb3a030-065f-11d1-bb9b-00a024ea5525
version: v1.0
annotation: Message Queuing - QMRT V1
protocol: [MS-MQMP]: Message Queuing (MSMQ):
provider: mqqm.dll
ncacn_ip_tcp: 210.242.49.110:2105
ncacn_ip_tcp: 210.242.49.110:2103
ncacn_ip_tcp: 210.242.49.110:2107
ncacn_ip_tcp: 210.242.49.110:1029
ncalrpc: QMMgmtFacility$server
ncalrpc: QMsvc$server
12d4b7c8-77d5-11d1-8c24-00c04fa3080d
version: v1.0
provider: lserver.dll
ncacn_ip_tcp: 210.242.49.110:1030
ncacn_np: \\SERVER\pipe\HydraLsPipe
ncalrpc: LRPC-9edc8b3a30bf20d722
3d267954-eeb7-11d1-b94e-00c04fa3080d
version: v1.0
provider: lserver.dll
ncacn_ip_tcp: 210.242.49.110:1030
ncacn_np: \\SERVER\pipe\HydraLsPipe
ncalrpc: LRPC-9edc8b3a30bf20d722
367abb81-9844-35f1-ad32-98f038001003
version: v2.0
protocol: [MS-SCMR]: Service Control Manager Remote Protocol
provider: services.exe
ncacn_ip_tcp: 210.242.49.110:1041
12345678-1234-abcd-ef00-0123456789ab
version: v1.0
annotation: IPSec Policy agent endpoint
protocol: [MS-RPRN]: Print System Remote Protocol
provider: spoolsv.exe
ncalrpc: LRPC-363646a512fa67ff45
ncacn_ip_tcp: 210.242.49.110:1042
6b5bdd1e-528c-422c-af8c-a4079be4fe48
version: v1.0
annotation: Remote Fw APIs
protocol: [MS-FASP]: Firewall and Advanced Security Protocol
provider: FwRemoteSvr.dll
ncacn_ip_tcp: 210.242.49.110:1042
906b0ce0-c70b-1067-b317-00dd010662da
version: v1.0
protocol: [MS-CMPO]: MSDTC Connection Manager:
provider: msdtcprx.dll
ncalrpc: LRPC-928e132690b68437a0
ncalrpc: LRPC-928e132690b68437a0
ncalrpc: LRPC-928e132690b68437a0
ncalrpc: LRPC-928e132690b68437a0
2074933174 | 2024-09-06T10:42:06.120032
445 /
tcp
SMB Status:
Authentication: enabled
SMB Version: 1
OS: Windows Server 2008 R2 Enterprise 7601 Service Pack 1
Software: Windows Server 2008 R2 Enterprise 6.1
Capabilities: extended-security, infolevel-passthru, large-files, large-readx, large-writex, level2-oplocks, lock-and-read, lwio, nt-find, nt-smb, nt-status, rpc-remote-api, unicode
-535406962 | 2024-09-10T23:35:49.018604
1801 /
tcp
\x10Z\x0b\x00LIOR<\x02\x00\x00\xff\xff\xff\xff\x00\x00\x12\x00\x06U=Q6\xdf\xc7@\x96C\x17\\<\xe7l\xaa?6RI\xcd\x9e\x91O\x82\xd7\xa1-8H\x13^\x00\x00\x00\x00\x10\x02\x00\x00ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
-214756495 | 2024-09-07T03:49:56.923493
3389 /
tcp
Remote Desktop Protocol
\x03\x00\x00\x13\x0e\xd0\x00\x00\x124\x00\x02\t\x08\x00\x02\x00\x00\x00
Remote Desktop Protocol NTLM Info:
OS: Windows 7/Windows Server 2008 R2
OS Build: 6.1.7601
Target Name: SERVER
NetBIOS Domain Name: SERVER
NetBIOS Computer Name: SERVER
DNS Domain Name: SERVER
FQDN: SERVER
SSL Certificate
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
2e:5a:99:59:38:09:e2:a7:4b:f2:8a:d4:42:a7:e7:18
Signature Algorithm: sha1WithRSAEncryption
Issuer: CN=SERVER
Validity
Not Before: Jun 30 17:00:17 2024 GMT
Not After : Dec 30 17:00:17 2024 GMT
Subject: CN=SERVER
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:a6:69:70:65:ae:0b:96:bd:62:3c:ed:7e:61:c8:
64:7f:93:7d:a1:c3:19:0c:e2:31:7f:9e:28:e4:ec:
21:53:35:15:50:60:22:ba:d9:b8:a4:26:b6:5d:46:
fc:2c:62:c4:55:6e:57:ba:ce:e4:04:8a:14:8c:f8:
56:4c:7b:f8:62:f2:94:d8:0b:d2:9a:92:a3:7d:76:
c5:78:d3:81:88:80:db:c1:7d:b6:8c:ee:5a:22:c8:
46:90:2f:dc:78:64:c0:28:8e:6a:45:ae:03:4f:06:
b1:3e:9f:1e:a5:b9:2e:43:03:96:66:47:35:8c:c2:
b0:82:18:0b:8d:62:91:5b:df:c5:95:95:5f:68:ef:
58:e6:0a:ad:8c:a8:69:bd:1e:4b:03:b2:5e:84:f4:
ba:1c:91:e6:ea:57:e6:9e:1f:3d:8b:07:e0:fd:5d:
3d:cb:bf:73:69:d9:9b:13:be:9f:3b:d2:56:9e:05:
cb:2c:e0:05:a5:46:e8:7e:33:36:33:0b:c7:06:8e:
00:83:a6:a2:f3:85:68:a5:4a:84:22:df:f9:8b:81:
a8:32:8d:e0:47:00:e1:e4:af:7b:46:63:40:a9:1d:
a2:9d:4e:03:e6:eb:dc:9e:97:82:cc:ff:84:e8:27:
76:19:06:76:c1:ef:ff:7a:ce:aa:25:fa:8f:1e:d7:
b9:7f
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Key Usage:
Key Encipherment, Data Encipherment
Signature Algorithm: sha1WithRSAEncryption
Signature Value:
62:27:f6:24:6e:15:04:c4:6b:85:94:69:44:46:38:a3:86:58:
cd:19:b4:4a:38:fd:09:3e:66:40:e4:cd:25:c7:36:3e:44:8a:
23:6f:bf:8d:d4:bc:1e:e2:f7:ee:d1:d5:d8:de:11:0d:f9:ac:
bd:27:e8:93:40:bd:7e:6d:4b:1f:fc:3a:12:c7:1c:68:65:fe:
55:ef:db:c3:00:ca:4b:28:db:95:74:98:e4:71:76:16:b4:8f:
c8:2f:ca:04:32:eb:d9:00:fe:77:a7:df:a6:2b:c4:69:ec:57:
b1:18:96:dc:7c:d4:0b:43:ae:cf:d5:f6:7f:d6:43:3d:ad:0a:
fb:64:ad:1a:d2:a5:f5:9f:46:1c:3a:bc:e2:14:47:63:46:08:
3e:53:23:7c:7f:b5:73:b8:46:3f:2e:88:4e:3c:68:89:20:23:
be:a3:2e:2c:a6:b2:03:9a:1d:b2:b4:2a:e3:4b:cb:d3:82:4b:
1d:e7:f8:f4:62:6d:be:ee:95:bc:dc:8e:31:72:87:51:68:a1:
15:db:8c:0e:9e:0b:d7:a9:9f:6b:66:7b:41:8a:41:bc:53:63:
3f:da:46:7b:b9:f2:50:c0:fd:10:13:77:0f:04:ea:5c:13:04:
d4:c7:6c:c5:09:85:57:41:ca:fb:45:3f:27:1b:c7:74:91:3a:
07:ad:84:4e
1489525118 | 2024-09-10T15:29:55.153156
5985 /
tcp
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Tue, 10 Sep 2024 15:29:53 GMT
Connection: close
Content-Length: 315
WinRM NTLM Info:
OS: Windows Server 2008 R2
OS Build: 6.1.7601
Target Name: SERVER
NetBIOS Domain Name: SERVER
NetBIOS Computer Name: SERVER
DNS Domain Name: SERVER
FQDN: SERVER