4104152150x0942057Microsoft-Windows-PowerShell/Operationalwin-dc-mhaag-attack-range-84.attackrange.local11Export-Certificate -Cert Cert:\CurrentUser\My\3E8CD9DFBF178FB09AEB263ADADBA32A6F5A0043 -FilePath c:\temp\test.ttt -Type CERT5352b286-4c82-44ca-9400-d40e66a3c4cc
4104152150x0942052Microsoft-Windows-PowerShell/Operationalwin-dc-mhaag-attack-range-84.attackrange.local11powershell.exe Export-Certificate -Cert Cert:\CurrentUser\My\3E8CD9DFBF178FB09AEB263ADADBA32A6F5A0043 -FilePath c:\temp\test.ttt -Type CERT39a5e864-850e-4aa1-b4c8-cecdf98ab926
4104152150x0942026Microsoft-Windows-PowerShell/Operationalwin-dc-mhaag-attack-range-84.attackrange.local11Export-Certificate -Cert Cert:\CurrentUser\My\3E8CD9DFBF178FB09AEB263ADADBA32A6F5A0043 -FilePath c:\temp\test.ttt -Type CERTb2f57d71-99e1-4ab1-a64e-a94aca654024
4104152150x0942021Microsoft-Windows-PowerShell/Operationalwin-dc-mhaag-attack-range-84.attackrange.local11powershell.exe Export-Certificate -Cert Cert:\CurrentUser\My\3E8CD9DFBF178FB09AEB263ADADBA32A6F5A0043 -FilePath c:\temp\test.ttt -Type CERTccaafd18-4112-4b49-bf1c-3bcebecdd32a
4104152150x0942003Microsoft-Windows-PowerShell/Operationalwin-dc-mhaag-attack-range-84.attackrange.local11Export-Certificate -Cert Cert:\CurrentUser\My\3E8CD9DFBF178FB09AEB263ADADBA32A6F5A0043 -FilePath c:\temp\test.ttt -Type CERT9609a9a1-2260-4f09-9635-fd67af7717da
4104152150x0941974Microsoft-Windows-PowerShell/Operationalwin-dc-mhaag-attack-range-84.attackrange.local11Export-Certificate -Cert 3E8CD9DFBF178FB09AEB263ADADBA32A6F5A0043 -FilePath c:\temp\test.ttt -Type CERT0a093405-86d6-4f40-a981-4d7355fa14fa
4104152150x0941958Microsoft-Windows-PowerShell/Operationalwin-dc-mhaag-attack-range-84.attackrange.local11Export-Certificate -Cert $cert -FilePath c:\temp\user.sst -Type SST4c9d0ecd-5df6-459b-bfa5-8fc1b2264199
410013106190x0941930Microsoft-Windows-PowerShell/Operationalwin-dc-mhaag-attack-range-84.attackrange.local Severity = Warning
Host Name = ConsoleHost
Host Version = 5.1.14393.5582
Host ID = e36ec838-45ed-4495-beb2-7355991f0946
Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Engine Version = 5.1.14393.5582
Runspace ID = 2feb7b00-2084-4a72-80a0-659b189e5c64
Pipeline ID = 82
Command Name = Export-Certificate
Command Type = Cmdlet
Script Name =
Command Path =
Sequence Number = 302
User = ATTACKRANGE\administrator
Connected User =
Shell ID = Microsoft.PowerShell
Error Message = The system cannot find the path specified. (Exception from HRESULT: 0x80070003)
Fully Qualified Error ID = System.IO.DirectoryNotFoundException,Microsoft.CertificateServices.Commands.ExportCertificateCommand
4104152150x0941928Microsoft-Windows-PowerShell/Operationalwin-dc-mhaag-attack-range-84.attackrange.local11Export-Certificate -Cert $cert -FilePath c:\certs\user.sst -Type SST74b86770-29ec-44da-8015-6121fce7dd7c
4104152150x0941499Microsoft-Windows-PowerShell/Operationalwin-dc-mhaag-attack-range-84.attackrange.local11Export-Certificate9c76c296-07cf-475e-9d1f-7424eefe7270
4104152150x0941494Microsoft-Windows-PowerShell/Operationalwin-dc-mhaag-attack-range-84.attackrange.local11powershell.exe Export-Certificatef19332ff-7237-4a0b-98b5-ac5f4c71c00b