13241300x800000000000000042661953Microsoft-Windows-Sysmon/Operationalmswin-dc01.attackrange.local-SetValue2023-03-27 20:17:41.601{2897A50F-F9E1-6421-C478-00000000C702}1880C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\EnableAtDWORD (0x00000001)ATTACKRANGE\Administrator 13241300x800000000000000045155241Microsoft-Windows-Sysmon/Operationalmswin-server.attackrange.local-SetValue2023-03-27 20:17:11.473{EF490992-8FD8-6421-F071-00000000C802}5580C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\EnableAtDWORD (0x00000001)MSWIN-SERVER\Administrator