154100x80000000000000004103205Microsoft-Windows-Sysmon/Operationalwin-dc-mhaag-attack-range-84.attackrange.local-2023-02-01 18:29:47.345{0F9A6540-AF9B-63DA-DD01-00000000BA02}5852C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Export-Certificate -Cert Cert:\CurrentUser\My\3E8CD9DFBF178FB09AEB263ADADBA32A6F5A0043 -FilePath c:\temp\test.ttt -Type CERTC:\Users\Administrator\ATTACKRANGE\Administrator{0F9A6540-9B21-63DA-EF88-5B0000000000}0x5b88ef2HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{0F9A6540-9B5C-63DA-C001-00000000BA02}6120C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" 154100x80000000000000004102739Microsoft-Windows-Sysmon/Operationalwin-dc-mhaag-attack-range-84.attackrange.local-2023-02-01 18:28:17.513{0F9A6540-AF41-63DA-DA01-00000000BA02}1504C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Export-Certificate -Cert Cert:\CurrentUser\My\3E8CD9DFBF178FB09AEB263ADADBA32A6F5A0043 -FilePath c:\temp\test.ttt -Type CERTC:\Users\Administrator\ATTACKRANGE\Administrator{0F9A6540-9B21-63DA-EF88-5B0000000000}0x5b88ef2HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{0F9A6540-9B5C-63DA-C001-00000000BA02}6120C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" 154100x80000000000000004099439Microsoft-Windows-Sysmon/Operationalwin-dc-mhaag-attack-range-84.attackrange.local-2023-02-01 18:14:15.066{0F9A6540-ABF7-63DA-CA01-00000000BA02}5416C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe10.0.14393.206 (rs1_release.160915-0644)Windows PowerShellMicrosoft® Windows® Operating SystemMicrosoft CorporationPowerShell.EXE"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Export-CertificateC:\Users\Administrator\ATTACKRANGE\Administrator{0F9A6540-9B21-63DA-EF88-5B0000000000}0x5b88ef2HighMD5=097CE5761C89434367598B34FE32893B,SHA256=BA4038FD20E474C047BE8AAD5BFACDB1BFC1DDBE12F803F473B7918D8D819436,IMPHASH=CAEE994F79D85E47C06E5FA9CDEAE453{0F9A6540-9B5C-63DA-C001-00000000BA02}6120C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"