O 90
P 76
S 1 object
S 1 property
S 1 value
S 1 string
S 1 boolean
S 1 observedschtask
S 1 observedconnection
S 1 observeddomain
S 1 observedfile
S 1 observedtimedelta
S 1 observeddomaincredential
S 1 observedhost
S 1 observedlocalcredential
S 1 observeddomainuser
S 1 num
S 1 object_type
S 1 observedshare
S 1 number
S 1 observedlocaluser
S 1 observedrat
S 2 prop_timedelta
S 2 prop_dns_domain_name
S 2 prop_fqdn
S 2 prop_password
S 2 prop_dc
S 2 mem_cached_domain_creds
S 2 prop_user
S 2 prop_hostname
S 2 prop_is_group
S 2 mem_domain_user_admins
S 2 prop_seconds
S 2 prop_microseconds
S 2 prop_windows_domain
S 2 prop_domain
S 2 prop_dns_domain
S 2 prop_username
S 2 prop_sid
S 1 arg_10
S 2 =
F 1 knows
F 1 created
F 2 knows_property
F 2 prop_src_host
F 2 prop_host
F 2 prop_share_name
F 2 prop_executable
F 2 prop_cred
F 2 prop_share_path
F 2 mem_hosts
F 2 prop_dest_host
F 2 prop_elevated
F 2 prop_path
F 0 procnone
F 0 do_5_2
F 0 do_5_3
F 0 do_5_4
F 0 do_5_5
F 0 do_6_2
F 0 do_6_3
F 0 do_6_4
F 0 do_6_5
F 0 do_8_2
F 0 do_8_3
F 0 do_8_4
F 0 do_8_5
F 0 do_8_6
F 1 arg_1
F 1 arg_2
F 1 arg_3
F 1 arg_4
F 1 arg_5
F 1 arg_6
F 1 arg_7
F 1 arg_8
F 1 arg_9
F 1 arg_11
N 1
A 0 total-cost
SI 398
0 0
1 0
0 1
1 1
0 2
1 2
0 3
2 3
3 3
0 4
1 4
0 5
1 5
0 6
1 6
0 7
1 7
0 8
1 8
0 9
1 9
0 10
1 10
0 11
1 11
0 12
1 12
0 13
1 13
0 14
1 14
0 15
1 15
0 16
1 16
0 17
1 17
0 18
1 18
0 19
1 19
0 20
1 20
0 21
2 21
3 21
0 22
1 22
0 23
1 23
0 24
1 24
0 25
1 25
0 26
1 26
0 27
1 27
0 28
1 28
0 29
2 29
4 29
0 30
1 30
0 31
1 31
0 32
1 32
0 33
1 33
0 34
1 34
0 35
1 35
0 36
1 36
0 37
1 37
0 38
1 38
0 39
2 39
4 39
0 40
2 40
3 40
0 41
1 41
0 42
1 42
0 43
2 43
15 43
7 43
0 44
2 44
15 44
16 44
0 45
2 45
15 45
16 45
15 46
0 46
2 46
10 46
15 47
0 47
2 47
10 47
15 48
0 48
2 48
10 48
15 49
0 49
2 49
10 49
0 50
2 50
14 50
0 51
2 51
14 51
0 52
2 52
14 52
0 53
2 53
14 53
0 54
2 54
15 54
19 54
0 55
2 55
15 55
19 55
0 56
2 56
15 56
19 56
0 57
2 57
15 57
5 57
0 58
2 58
15 58
5 58
0 59
2 59
3 59
0 60
2 60
3 60
0 61
2 61
3 61
0 62
2 62
3 62
0 63
2 63
3 63
0 64
2 64
3 64
0 65
2 65
3 65
0 66
2 66
3 66
0 67
2 67
3 67
0 68
2 68
3 68
0 69
2 69
3 69
0 70
2 70
3 70
0 71
2 71
3 71
0 72
2 72
3 72
0 73
2 73
3 73
0 74
2 74
3 74
0 75
2 75
3 75
0 76
2 76
3 76
0 77
2 77
3 77
0 78
2 78
3 78
0 79
2 79
3 79
0 80
2 80
15 80
11 80
0 81
2 81
15 81
11 81
0 82
2 82
15 82
9 82
0 83
2 83
15 83
9 83
0 84
2 84
15 84
13 84
0 85
2 85
15 85
13 85
0 86
2 86
15 86
13 86
0 87
2 87
15 87
13 87
0 88
2 88
15 88
8 88
0 89
2 89
15 89
8 89
25 80 49
25 80 48
25 81 49
25 81 46
29 80 87
29 80 85
29 81 87
29 81 84
24 80 29
24 81 29
34 43 69
21 80 63
21 81 61
33 87 43
33 49 43
33 85 43
33 48 43
33 86 43
33 46 43
33 84 43
33 47 43
33 80 43
33 81 43
22 80 70
22 81 72
27 80 74
27 81 77
28 87 39
28 85 39
28 86 39
28 84 39
31 82 51
31 83 50
23 49 66
23 48 75
23 46 76
23 47 62
30 82 52
30 83 53
36 87 65
36 85 67
36 86 73
36 84 71
20 80 83
20 81 82
26 49 87
26 48 85
26 46 86
26 47 84
35 87 78
35 85 64
35 86 60
35 84 59
32 43 79
38 0 0
38 1 1
38 2 2
38 3 3
38 4 4
38 5 5
38 6 6
38 7 7
38 8 8
38 9 9
38 10 10
38 11 11
38 12 12
38 13 13
38 14 14
38 15 15
38 16 16
38 17 17
38 18 18
38 19 19
38 20 20
38 21 21
38 22 22
38 23 23
38 24 24
38 25 25
38 26 26
38 27 27
38 28 28
38 29 29
38 30 30
38 31 31
38 32 32
38 33 33
38 34 34
38 35 35
38 36 36
38 37 37
38 38 38
38 39 39
38 40 40
38 41 41
38 42 42
38 43 43
38 44 44
38 45 45
38 46 46
38 47 47
38 48 48
38 49 49
38 50 50
38 51 51
38 52 52
38 53 53
38 54 54
38 55 55
38 56 56
38 57 57
38 58 58
38 59 59
38 60 60
38 61 61
38 62 62
38 63 63
38 64 64
38 65 65
38 66 66
38 67 67
38 68 68
38 69 69
38 70 70
38 71 71
38 72 72
38 73 73
38 74 74
38 75 75
38 76 76
38 77 77
38 78 78
38 79 79
38 80 80
38 81 81
38 82 82
38 83 83
38 84 84
38 85 85
38 86 86
38 87 87
38 88 88
38 89 89
FI 17
52
39 54
39 80
41 54 36
41 54 30
41 80 38
48 43 80
48 43 81
46 87 49
46 85 48
46 86 46
46 84 47
50 54 29
45 54 68
43 82 81
43 54 80
43 83 80
NI 1
0 0
G 2
52 1
43 1 56 81
NG 0
M min 1 a 0
A 21
get_domain_1 3
L 19
2 1 0
0 1 0
15 1 0
19 1 0
2 1 1
0 1 1
15 1 1
11 1 1
0 1 2
2 1 2
3 1 2
22 1 1 2
41 1 1 -39
41 1 0 -31
43 1 0 1
39 1 1
39 1 0
52 1
52 1
NC 0
E 2
0
L 0
NC 0
F 0
NE 0
NA increase 1 c 6
1
L 5
2 1 3
0 1 3
15 1 3
7 1 3
33 1 1 3
NC 0
F 6
41 1 3 -1
41 1 3 -15
41 1 3 -25
48 1 3 1
41 1 1 -14
39 1 3
NE 0
NA -
get_computers_1 2
L 12
2 1 0
0 1 0
15 1 0
19 1 0
0 1 1
2 1 1
15 1 1
7 1 1
39 1 0
52 1
39 1 1
52 1
NC 0
E 2
1
L 5
2 1 2
0 1 2
15 1 2
11 1 2
33 1 2 1
NC 0
F 4
41 1 2 -39
48 1 1 2
41 1 2 -14
39 1 2
NE 0
NA -
0
L 0
NC 0
F 1
41 1 1 -25
NE 0
NA increase 1 c 6
get_admin_1 3
L 17
2 1 0
0 1 0
15 1 0
19 1 0
2 1 1
0 1 1
15 1 1
11 1 1
0 1 2
2 1 2
15 1 2
7 1 2
39 1 1
39 1 0
52 1
39 1 2
52 1
NC 0
E 2
1
L 5
2 1 3
0 1 3
15 1 3
13 1 3
29 1 1 3
NC 0
F 5
39 1 3
41 1 3 -14
41 1 3 -10
41 1 3 -29
41 1 3 -38
NE 0
NA -
0
L 0
NC 0
F 1
41 1 1 -34
NE 0
NA increase 1 c 6
creds_1 3
L 19
2 1 0
0 1 0
15 1 0
19 1 0
2 1 1
0 1 1
15 1 1
11 1 1
2 1 2
0 1 2
15 1 2
7 1 2
41 1 0 -31
43 1 0 1
39 1 1
39 1 0
52 1
39 1 2
52 1
NC 0
E 2
2
L 11
2 1 3
0 1 3
15 1 3
10 1 3
2 1 4
0 1 4
15 1 4
13 1 4
25 1 1 3
50 1 0 -30
46 1 4 3
NC 0
F 11
39 1 3
39 1 2
46 1 4 3
41 1 2 -15
41 1 4 -14
41 1 4 -10
41 1 4 -38
41 1 4 -18
41 1 3 -5
39 1 4
41 1 3 -21
NE 0
NA -
0
L 0
NC 0
F 0
NE 0
NA increase 1 c 6
net_use_1 4
L 22
2 1 2
0 1 2
15 1 2
7 1 2
2 1 0
0 1 0
15 1 0
13 1 0
0 1 1
2 1 1
3 1 1
0 1 3
2 1 3
3 1 3
32 1 2 3
33 1 0 2
35 1 0 1
52 1
41 1 0 -14
41 1 0 -38
39 1 0
52 1
NC 0
E 1
0
L 0
NC 0
F 4
52 0
53 1
72 1 0
74 1 2
NE 0
NA increase 1 c 2
net_use_2 4
L 25
2 1 0
0 1 0
15 1 0
19 1 0
2 1 3
0 1 3
15 1 3
13 1 3
2 1 1
0 1 1
15 1 1
10 1 1
0 1 2
2 1 2
3 1 2
26 1 1 3
23 1 1 2
41 1 0 -31
39 1 0
53 1
72 1 3
41 1 1 -5
41 1 1 -21
39 1 1
53 1
NC 0
E 1
0
L 0
NC 0
F 3
54 1
53 0
66 1 0
NE 0
NA increase 1 c 1
net_use_3 4
L 26
0 1 1
2 1 1
15 1 1
2 1 2
0 1 2
15 1 2
7 1 2
2 1 0
0 1 0
15 1 0
11 1 0
11 1 1
2 1 3
0 1 3
15 1 3
16 1 3
38 0 0 1
39 1 1
39 1 2
41 1 2 -15
74 1 2
54 1
39 1 0
40 0 3
41 1 1 -39
54 1
NC 0
E 1
0
L 0
NC 0
F 6
55 1
54 0
67 1 0
68 1 1
74 0 2
75 1 3
NE 0
NA increase 1 c 1
net_use_4 4
L 22
2 1 0
0 1 0
15 1 0
19 1 0
2 1 1
0 1 1
15 1 1
11 1 1
0 1 2
2 1 2
15 1 2
11 1 2
0 1 3
2 1 3
3 1 3
22 1 2 3
43 1 0 1
66 1 0
55 1
67 1 1
68 1 2
55 1
NC 0
E 1
0
L 0
NC 0
F 3
56 1
55 0
66 0 0
NE 0
NA increase 1 c 1
net_use_5 4
L 22
0 1 1
2 1 1
15 1 1
2 1 0
0 1 0
15 1 0
11 1 0
11 1 1
2 1 3
0 1 3
15 1 3
16 1 3
2 1 2
0 1 2
15 1 2
13 1 2
67 1 0
68 1 1
75 1 3
56 1
72 1 2
56 1
NC 0
E 2
0
L 1
29 1 1 2
NC 0
F 10
47 1 3 -22
41 1 3 -36
44 1 3 -4
41 1 3 -6
49 1 3 1
41 1 3 -42
42 1 3 0
41 1 3 -2
40 1 3
39 1 3
NE 0
NA -
0
L 0
NC 0
F 6
52 1
56 0
67 0 0
68 0 1
72 0 2
75 0 3
NE 0
NA increase 1 c 1
smb_copy_1 3
L 18
2 1 0
0 1 0
15 1 0
19 1 0
2 1 1
0 1 1
15 1 1
11 1 1
0 1 2
2 1 2
3 1 2
41 1 0 -31
43 1 0 1
39 1 0
52 1
41 1 0 -37
45 1 0 2
52 1
NC 0
E 1
0
L 0
NC 0
F 4
52 0
66 1 0
67 1 1
57 1
NE 0
NA increase 1 c 2
smb_copy_2 3
L 22
2 1 0
0 1 0
15 1 0
11 1 0
2 1 2
0 1 2
15 1 2
0 1 1
2 1 1
15 1 1
16 1 1
11 1 2
38 1 0 2
67 1 0
57 1
39 1 2
41 1 1 -36
41 1 1 -42
41 1 1 -2
42 1 1 2
39 1 1
57 1
NC 0
E 1
0
L 0
NC 0
F 3
58 1
57 0
69 1 1
NE 0
NA increase 1 c 1
smb_copy_3 3
L 19
2 1 0
0 1 0
15 1 0
11 1 0
0 1 2
2 1 2
0 1 1
2 1 1
15 1 1
11 1 1
15 1 2
8 1 2
38 0 0 1
39 1 0
67 1 0
58 1
40 0 2
39 1 1
58 1
NC 0
E 1
0
L 0
NC 0
F 5
67 0 0
59 1
58 0
71 1 1
73 1 2
NE 0
NA increase 1 c 1
smb_copy_4 3
L 17
2 1 2
0 1 2
0 1 1
2 1 1
15 1 1
11 1 1
0 1 0
2 1 0
15 1 0
16 1 0
3 1 2
59 1
71 1 1
69 1 0
47 1 0 2
49 1 0 1
59 1
NC 0
E 1
0
L 0
NC 0
F 3
60 1
59 0
69 0 0
NE 0
NA increase 1 c 1
smb_copy_5 3
L 17
2 1 0
0 1 0
15 1 0
19 1 0
0 1 2
2 1 2
0 1 1
2 1 1
15 1 1
11 1 1
15 1 2
8 1 2
66 1 0
71 1 1
73 1 2
60 1
60 1
NC 0
E 2
0
L 1
50 1 0 -30
NC 0
F 6
43 1 2 1
41 1 2 -31
51 1 2 -41
41 1 2 -26
40 1 2
39 1 2
NE 0
NA -
0
L 0
NC 0
F 5
52 1
66 0 0
60 0
71 0 1
73 0 2
NE 0
NA increase 1 c 1
net_time_1 3
L 16
2 1 0
0 1 0
15 1 0
19 1 0
2 1 1
0 1 1
15 1 1
11 1 1
0 1 2
2 1 2
15 1 2
9 1 2
39 1 1
39 1 0
52 1
52 1
NC 0
E 1
0
L 0
NC 0
F 6
39 1 2
41 1 1 -17
43 1 2 1
41 1 2 -31
41 1 2 -12
41 1 2 -28
NE 0
NA increase 1 c 6
wmic_1 4
L 21
2 1 0
0 1 0
15 1 0
19 1 0
0 1 1
2 1 1
15 1 1
11 1 1
2 1 3
0 1 3
0 1 2
2 1 2
15 1 2
8 1 2
3 1 3
41 1 0 -31
39 1 0
52 1
43 1 2 1
51 1 2 3
52 1
NC 0
E 1
0
L 0
NC 0
F 6
52 0
66 1 0
68 1 1
69 1 2
61 1
70 1 3
NE 0
NA increase 1 c 1
wmic_2 4
L 26
0 1 2
2 1 2
15 1 2
0 1 0
2 1 0
15 1 0
2 1 3
0 1 3
15 1 3
7 1 3
2 1 1
0 1 1
15 1 1
8 1 0
10 1 1
13 1 2
33 1 2 3
26 1 1 2
69 1 0
39 1 2
61 1
39 1 0
41 1 2 -14
41 1 0 -31
41 1 0 -26
61 1
NC 0
E 1
0
L 0
NC 0
F 6
69 0 0
62 1
61 0
71 1 1
72 1 2
73 1 3
NE 0
NA increase 1 c 1
wmic_3 4
L 22
2 1 0
0 1 0
15 1 0
2 1 3
0 1 3
2 1 1
0 1 1
15 1 1
7 1 1
0 1 2
2 1 2
3 1 2
32 1 1 2
10 1 0
3 1 3
23 1 0 3
62 1
39 1 1
41 1 1 -15
71 1 0
73 1 1
62 1
NC 0
E 1
0
L 0
NC 0
F 3
63 1
62 0
73 0 1
NE 0
NA increase 1 c 1
wmic_4 4
L 28
0 1 1
2 1 1
15 1 1
2 1 0
0 1 0
15 1 0
11 1 0
11 1 1
38 0 0 1
2 1 2
0 1 2
15 1 2
10 1 2
2 1 3
0 1 3
15 1 3
19 1 3
39 1 1
39 1 0
68 1 1
63 1
39 1 2
71 1 2
40 0 3
41 1 2 -21
41 1 2 -5
41 1 1 -34
63 1
NC 0
E 1
0
L 0
NC 0
F 5
67 1 0
64 1
63 0
71 0 2
75 1 3
NE 0
NA increase 1 c 1
wmic_5 2
L 13
2 1 0
0 1 0
15 1 0
19 1 0
2 1 1
0 1 1
15 1 1
11 1 1
43 1 0 1
66 1 0
67 1 1
64 1
64 1
NC 0
E 1
0
L 0
NC 0
F 4
66 0 0
67 0 1
65 1
64 0
NE 0
NA increase 1 c 1
wmic_6 4
L 21
2 1 1
0 1 1
0 1 2
2 1 2
15 1 2
13 1 2
2 1 3
0 1 3
15 1 3
19 1 3
0 1 0
2 1 0
15 1 0
11 1 0
3 1 1
72 1 2
75 1 3
65 1
68 1 0
70 1 1
65 1
NC 0
E 2
0
L 1
29 1 0 2
NC 0
F 8
45 1 3 1
41 1 3 -37
50 1 3 -30
41 1 3 -23
43 1 3 0
41 1 3 -31
40 1 3
39 1 3
NE 0
NA -
0
L 0
NC 0
F 6
52 1
68 0 0
65 0
70 0 1
72 0 2
75 0 3
NE 0
NA increase 1 c 1
X 0
