4688201331200x80200000000000007497827Securitywin-dc-mhaag-attack-range-622.attackrange.localATTACKRANGE\AdministratoradministratorATTACKRANGE0x1cfe160x124C:\Windows\System32\reg.exe%%19360x17c0"C:\Windows\system32\reg.exe" add HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\InprocServer32 /v ThreadingModel /T REG_SZ /d Apartment /fNULL SID--0x0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMandatory Label\High Mandatory Level 4688201331200x80200000000000007497825Securitywin-dc-mhaag-attack-range-622.attackrange.localATTACKRANGE\AdministratoradministratorATTACKRANGE0x1cfe160x9d0C:\Windows\System32\reg.exe%%19360x17c0"C:\Windows\system32\reg.exe" add HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\InprocServer32 /ve /T REG_SZ /d C:\WINDOWS\system32\scrobj.dll /fNULL SID--0x0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMandatory Label\High Mandatory Level