12241200x800000000000000014236Microsoft-Windows-Sysmon/Operationalar-win-dc2-DeleteValue2025-08-20 14:49:14.503{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLAR-WIN-DC2\Administrator 13241300x800000000000000014235Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.488{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLDWORD (0x00000001)AR-WIN-DC2\Administrator 13241300x800000000000000014234Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.488{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014233Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.488{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLDWORD (0x00000001)AR-WIN-DC2\Administrator 12241200x800000000000000014232Microsoft-Windows-Sysmon/Operationalar-win-dc2-DeleteValue2025-08-20 14:49:14.488{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsAR-WIN-DC2\Administrator 13241300x800000000000000014231Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.488{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsDWORD (0x00000001)AR-WIN-DC2\Administrator 13241300x800000000000000014230Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.488{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014229Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.488{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsDWORD (0x00000001)AR-WIN-DC2\Administrator 12241200x800000000000000014228Microsoft-Windows-Sysmon/Operationalar-win-dc2-DeleteValue2025-08-20 14:49:14.471{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RunAsPPLAR-WIN-DC2\Administrator 13241300x800000000000000014227Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.471{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RunAsPPLDWORD (0x00000001)AR-WIN-DC2\Administrator 13241300x800000000000000014226Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.471{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RunAsPPLDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014225Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.471{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RunAsPPLDWORD (0x00000001)AR-WIN-DC2\Administrator 12241200x800000000000000014224Microsoft-Windows-Sysmon/Operationalar-win-dc2-DeleteValue2025-08-20 14:49:14.471{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlagsAR-WIN-DC2\Administrator 13241300x800000000000000014223Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.471{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlagsDWORD (0x00000001)AR-WIN-DC2\Administrator 13241300x800000000000000014222Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.471{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlagsDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014221Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.471{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlagsDWORD (0x00000001)AR-WIN-DC2\Administrator 12241200x800000000000000014220Microsoft-Windows-Sysmon/Operationalar-win-dc2-DeleteValue2025-08-20 14:49:14.455{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLAR-WIN-DC2\Administrator 13241300x800000000000000014219Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.455{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLDWORD (0x00000001)AR-WIN-DC2\Administrator 13241300x800000000000000014218Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.455{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014217Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.455{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLDWORD (0x00000001)AR-WIN-DC2\Administrator 12241200x800000000000000014216Microsoft-Windows-Sysmon/Operationalar-win-dc2-DeleteValue2025-08-20 14:49:14.455{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsAR-WIN-DC2\Administrator 13241300x800000000000000014215Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.440{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsDWORD (0x00000001)AR-WIN-DC2\Administrator 13241300x800000000000000014214Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.440{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014213Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:49:14.440{53FBDF3C-E069-68A5-660C-00000000EE03}2524C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsDWORD (0x00000001)AR-WIN-DC2\Administrator 12241200x800000000000000014193Microsoft-Windows-Sysmon/Operationalar-win-dc2-DeleteValue2025-08-20 14:47:38.809{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLAR-WIN-DC2\Administrator 13241300x800000000000000014192Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.809{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014191Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.809{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014190Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.803{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLDWORD (0x00000000)AR-WIN-DC2\Administrator 12241200x800000000000000014189Microsoft-Windows-Sysmon/Operationalar-win-dc2-DeleteValue2025-08-20 14:47:38.803{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsAR-WIN-DC2\Administrator 13241300x800000000000000014188Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.788{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014187Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.788{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014186Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.788{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsDWORD (0x00000000)AR-WIN-DC2\Administrator 12241200x800000000000000014185Microsoft-Windows-Sysmon/Operationalar-win-dc2-DeleteValue2025-08-20 14:47:38.788{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RunAsPPLAR-WIN-DC2\Administrator 13241300x800000000000000014184Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.788{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RunAsPPLDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014183Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.788{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RunAsPPLDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014182Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.788{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\RunAsPPLDWORD (0x00000000)AR-WIN-DC2\Administrator 12241200x800000000000000014181Microsoft-Windows-Sysmon/Operationalar-win-dc2-DeleteValue2025-08-20 14:47:38.785{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlagsAR-WIN-DC2\Administrator 13241300x800000000000000014180Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.783{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlagsDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014179Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.781{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlagsDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014178Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.778{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\LsaCfgFlagsDWORD (0x00000000)AR-WIN-DC2\Administrator 12241200x800000000000000014177Microsoft-Windows-Sysmon/Operationalar-win-dc2-DeleteValue2025-08-20 14:47:38.756{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLAR-WIN-DC2\Administrator 13241300x800000000000000014176Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.756{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014175Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.756{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014174Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.756{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\RunAsPPLDWORD (0x00000000)AR-WIN-DC2\Administrator 12241200x800000000000000014173Microsoft-Windows-Sysmon/Operationalar-win-dc2-DeleteValue2025-08-20 14:47:38.756{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsAR-WIN-DC2\Administrator 13241300x800000000000000014172Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.740{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014171Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.740{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsDWORD (0x00000000)AR-WIN-DC2\Administrator 13241300x800000000000000014170Microsoft-Windows-Sysmon/Operationalar-win-dc2-SetValue2025-08-20 14:47:38.740{53FBDF3C-E00A-68A5-570C-00000000EE03}3316C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKLM\System\CurrentControlSet\Control\Lsa\LsaCfgFlagsDWORD (0x00000000)AR-WIN-DC2\Administrator