Use the Sysinternals Sysmon tool to get better visibility into activity on Windows endpoints. It should be configured to log network events (use the -n switch). Specify * as the hash type to include all options.
sysmon.exe –i –accepteula –n –h md5,imphash -n
To verify your configuration, use:
sysmon –c
For example:
.png)