03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953995 Keywords=None Message=Started invocation of ScriptBlock ID: 4cf438a2-c825-4abf-aae8-3d68f71a44f5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953994 Keywords=None Message=Completed invocation of ScriptBlock ID: f18ff060-e3fa-45a4-af01-40434d860551 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953993 Keywords=None Message=Completed invocation of ScriptBlock ID: 3ed0cb33-c8c0-4dd4-8260-8fd7b6dc2789 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953992 Keywords=None Message=Started invocation of ScriptBlock ID: 3ed0cb33-c8c0-4dd4-8260-8fd7b6dc2789 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953991 Keywords=None Message=Started invocation of ScriptBlock ID: f18ff060-e3fa-45a4-af01-40434d860551 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=2953990 Keywords=None Message=Creating Scriptblock text (1 of 1): prompt ScriptBlock ID: f18ff060-e3fa-45a4-af01-40434d860551 Path: 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953989 Keywords=None Message=Completed invocation of ScriptBlock ID: a3d3009f-ad00-4a86-88f2-56f49dcc8630 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953988 Keywords=None Message=Started invocation of ScriptBlock ID: a3d3009f-ad00-4a86-88f2-56f49dcc8630 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953987 Keywords=None Message=Completed invocation of ScriptBlock ID: f040ebb6-9fec-4bc6-9986-03ca2fa470ec Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953986 Keywords=None Message=Completed invocation of ScriptBlock ID: 2458a2b9-0337-49e4-a9ac-580a3b735a60 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953985 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953984 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953983 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953982 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953981 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953980 Keywords=None Message=Completed invocation of ScriptBlock ID: 285f93a0-e16a-459e-b7d5-eb1973ca9fe9 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953979 Keywords=None Message=Started invocation of ScriptBlock ID: 285f93a0-e16a-459e-b7d5-eb1973ca9fe9 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953978 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953977 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953976 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953975 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953974 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953973 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953972 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953971 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953970 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953969 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953968 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953967 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953966 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953965 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953964 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953963 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953962 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953961 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953960 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953959 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953958 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953957 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953956 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953955 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953954 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953953 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953952 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953951 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953950 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953949 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953948 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953947 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953946 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953945 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953944 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953943 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953942 Keywords=None Message=Completed invocation of ScriptBlock ID: c8bea148-5e43-4846-876d-ff9c7723a29a Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953941 Keywords=None Message=Started invocation of ScriptBlock ID: c8bea148-5e43-4846-876d-ff9c7723a29a Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953940 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953939 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953938 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953937 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953936 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953935 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953934 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953933 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953932 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953931 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953930 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953929 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953928 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953927 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953926 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953925 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953924 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953923 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953922 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953921 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953920 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953919 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953918 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953917 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953916 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953915 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953914 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953913 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953912 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953911 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953910 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953909 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953908 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953907 Keywords=None Message=Started invocation of ScriptBlock ID: 2458a2b9-0337-49e4-a9ac-580a3b735a60 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953906 Keywords=None Message=Completed invocation of ScriptBlock ID: bb9602bd-8617-4aa1-a4a9-0807ffc6ad08 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953905 Keywords=None Message=Started invocation of ScriptBlock ID: bb9602bd-8617-4aa1-a4a9-0807ffc6ad08 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953904 Keywords=None Message=Completed invocation of ScriptBlock ID: 62469338-3192-4ca9-80a3-d792bf4f34e1 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953903 Keywords=None Message=Started invocation of ScriptBlock ID: 62469338-3192-4ca9-80a3-d792bf4f34e1 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953902 Keywords=None Message=Completed invocation of ScriptBlock ID: d1287202-590c-4d55-a7ba-b678abed8d93 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953901 Keywords=None Message=Started invocation of ScriptBlock ID: d1287202-590c-4d55-a7ba-b678abed8d93 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953900 Keywords=None Message=Completed invocation of ScriptBlock ID: ab68eae5-8011-4b31-97a0-74d29d34bc33 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953899 Keywords=None Message=Started invocation of ScriptBlock ID: ab68eae5-8011-4b31-97a0-74d29d34bc33 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953898 Keywords=None Message=Completed invocation of ScriptBlock ID: a1aa3fd3-c4b5-44d6-bb96-5b02522c1f34 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953897 Keywords=None Message=Started invocation of ScriptBlock ID: a1aa3fd3-c4b5-44d6-bb96-5b02522c1f34 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953896 Keywords=None Message=Completed invocation of ScriptBlock ID: c337e55e-b5c6-4cab-a3d6-534bc4374949 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953895 Keywords=None Message=Started invocation of ScriptBlock ID: c337e55e-b5c6-4cab-a3d6-534bc4374949 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953894 Keywords=None Message=Completed invocation of ScriptBlock ID: c337e55e-b5c6-4cab-a3d6-534bc4374949 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953893 Keywords=None Message=Started invocation of ScriptBlock ID: c337e55e-b5c6-4cab-a3d6-534bc4374949 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953892 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953891 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953890 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953889 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953888 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953887 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953886 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953885 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953884 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953883 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953882 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953881 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953880 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953879 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953878 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953877 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953876 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953875 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953874 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953873 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953872 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953871 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953870 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953869 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953868 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953867 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953866 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953865 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953864 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953863 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953862 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953861 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953860 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953859 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953858 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953857 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953856 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953855 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953854 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953853 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953852 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953851 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953850 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953849 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953848 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953847 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953846 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953845 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953844 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953843 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953842 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953841 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953840 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953839 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953838 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953837 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953836 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953835 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953834 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953833 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953832 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953831 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953830 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953829 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953828 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953827 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953826 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953825 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953824 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953823 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953822 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953821 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953820 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953819 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953818 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953817 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953816 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953815 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953814 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953813 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953812 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953811 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953810 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953809 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953808 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953807 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953806 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953805 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953804 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953803 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953802 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953801 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953800 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953799 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953798 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953797 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953796 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953795 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953794 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953793 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953792 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953791 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953790 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953789 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953788 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953787 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953786 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953785 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953784 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953783 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953782 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953781 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953780 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953779 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953778 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953777 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953776 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953775 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953774 Keywords=None Message=Completed invocation of ScriptBlock ID: 502e0f30-593f-4f1c-934d-442efa888b45 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953773 Keywords=None Message=Started invocation of ScriptBlock ID: 502e0f30-593f-4f1c-934d-442efa888b45 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953772 Keywords=None Message=Completed invocation of ScriptBlock ID: 502e0f30-593f-4f1c-934d-442efa888b45 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953771 Keywords=None Message=Started invocation of ScriptBlock ID: 502e0f30-593f-4f1c-934d-442efa888b45 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953770 Keywords=None Message=Completed invocation of ScriptBlock ID: 502e0f30-593f-4f1c-934d-442efa888b45 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953769 Keywords=None Message=Started invocation of ScriptBlock ID: 502e0f30-593f-4f1c-934d-442efa888b45 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953768 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953767 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953766 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953765 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953764 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953763 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953762 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953761 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953760 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953759 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953758 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953757 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953756 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953755 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953754 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953753 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953752 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953751 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953750 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953749 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953748 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953747 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953746 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953745 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953744 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953743 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953742 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953741 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953740 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953739 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953738 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953737 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953736 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953735 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953734 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953733 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953732 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953731 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953730 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953729 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953728 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953727 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953726 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953725 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953724 Keywords=None Message=Started invocation of ScriptBlock ID: f040ebb6-9fec-4bc6-9986-03ca2fa470ec Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=2953723 Keywords=None Message=Creating Scriptblock text (1 of 1): Get-NetComputer -TrustedToAuth ScriptBlock ID: f040ebb6-9fec-4bc6-9986-03ca2fa470ec Path: 03/31/2022 06:15:36 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953722 Keywords=None Message=Completed invocation of ScriptBlock ID: 4cf438a2-c825-4abf-aae8-3d68f71a44f5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954269 Keywords=None Message=Started invocation of ScriptBlock ID: 4cf438a2-c825-4abf-aae8-3d68f71a44f5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954268 Keywords=None Message=Completed invocation of ScriptBlock ID: 15748d41-fd03-48d6-bbd8-09ada02e3899 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954267 Keywords=None Message=Completed invocation of ScriptBlock ID: 3ed0cb33-c8c0-4dd4-8260-8fd7b6dc2789 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954266 Keywords=None Message=Started invocation of ScriptBlock ID: 3ed0cb33-c8c0-4dd4-8260-8fd7b6dc2789 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954265 Keywords=None Message=Started invocation of ScriptBlock ID: 15748d41-fd03-48d6-bbd8-09ada02e3899 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=2954264 Keywords=None Message=Creating Scriptblock text (1 of 1): prompt ScriptBlock ID: 15748d41-fd03-48d6-bbd8-09ada02e3899 Path: 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954263 Keywords=None Message=Completed invocation of ScriptBlock ID: a3d3009f-ad00-4a86-88f2-56f49dcc8630 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954262 Keywords=None Message=Started invocation of ScriptBlock ID: a3d3009f-ad00-4a86-88f2-56f49dcc8630 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954261 Keywords=None Message=Completed invocation of ScriptBlock ID: f4cb33a3-90bf-45ac-ba1d-af23ce7f1223 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954260 Keywords=None Message=Completed invocation of ScriptBlock ID: 2458a2b9-0337-49e4-a9ac-580a3b735a60 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954259 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954258 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954257 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954256 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954255 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954254 Keywords=None Message=Completed invocation of ScriptBlock ID: 285f93a0-e16a-459e-b7d5-eb1973ca9fe9 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954253 Keywords=None Message=Started invocation of ScriptBlock ID: 285f93a0-e16a-459e-b7d5-eb1973ca9fe9 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954252 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954251 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954250 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954249 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954248 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954247 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954246 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954245 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954244 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954243 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954242 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954241 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954240 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954239 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954238 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954237 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954236 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954235 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954234 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954233 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954232 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954231 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954230 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954229 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954228 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954227 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954226 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954225 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954224 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954223 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954222 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954221 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954220 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954219 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954218 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954217 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954216 Keywords=None Message=Completed invocation of ScriptBlock ID: c8bea148-5e43-4846-876d-ff9c7723a29a Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954215 Keywords=None Message=Started invocation of ScriptBlock ID: c8bea148-5e43-4846-876d-ff9c7723a29a Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954214 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954213 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954212 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954211 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954210 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954209 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954208 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954207 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954206 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954205 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954204 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954203 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954202 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954201 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954200 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954199 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954198 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954197 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954196 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954195 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954194 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954193 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954192 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954191 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954190 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954189 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954188 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954187 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954186 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954185 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954184 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954183 Keywords=None Message=Completed invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954182 Keywords=None Message=Started invocation of ScriptBlock ID: 7830d980-8d01-4a2c-a93a-88085cd033a5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954181 Keywords=None Message=Started invocation of ScriptBlock ID: 2458a2b9-0337-49e4-a9ac-580a3b735a60 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954180 Keywords=None Message=Completed invocation of ScriptBlock ID: bb9602bd-8617-4aa1-a4a9-0807ffc6ad08 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954179 Keywords=None Message=Started invocation of ScriptBlock ID: bb9602bd-8617-4aa1-a4a9-0807ffc6ad08 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954178 Keywords=None Message=Completed invocation of ScriptBlock ID: 62469338-3192-4ca9-80a3-d792bf4f34e1 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954177 Keywords=None Message=Started invocation of ScriptBlock ID: 62469338-3192-4ca9-80a3-d792bf4f34e1 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954176 Keywords=None Message=Completed invocation of ScriptBlock ID: d1287202-590c-4d55-a7ba-b678abed8d93 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954175 Keywords=None Message=Started invocation of ScriptBlock ID: d1287202-590c-4d55-a7ba-b678abed8d93 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954174 Keywords=None Message=Completed invocation of ScriptBlock ID: ab68eae5-8011-4b31-97a0-74d29d34bc33 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954173 Keywords=None Message=Started invocation of ScriptBlock ID: ab68eae5-8011-4b31-97a0-74d29d34bc33 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954172 Keywords=None Message=Completed invocation of ScriptBlock ID: a1aa3fd3-c4b5-44d6-bb96-5b02522c1f34 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954171 Keywords=None Message=Started invocation of ScriptBlock ID: a1aa3fd3-c4b5-44d6-bb96-5b02522c1f34 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954170 Keywords=None Message=Completed invocation of ScriptBlock ID: c337e55e-b5c6-4cab-a3d6-534bc4374949 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954169 Keywords=None Message=Started invocation of ScriptBlock ID: c337e55e-b5c6-4cab-a3d6-534bc4374949 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954168 Keywords=None Message=Completed invocation of ScriptBlock ID: c337e55e-b5c6-4cab-a3d6-534bc4374949 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954167 Keywords=None Message=Started invocation of ScriptBlock ID: c337e55e-b5c6-4cab-a3d6-534bc4374949 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954166 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954165 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954164 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954163 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954162 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954161 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954160 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954159 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954158 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954157 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954156 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954155 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954154 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954153 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954152 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954151 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954150 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954149 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954148 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954147 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954146 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954145 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954144 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954143 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954142 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954141 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954140 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954139 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954138 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954137 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954136 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954135 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954134 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954133 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954132 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954131 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954130 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954129 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954128 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954127 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954126 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954125 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954124 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954123 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954122 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954121 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954120 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954119 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954118 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954117 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954116 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954115 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954114 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954113 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954112 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954111 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954110 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954109 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954108 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954107 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954106 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954105 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954104 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954103 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954102 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954101 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954100 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954099 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954098 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954097 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954096 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954095 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954094 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954093 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954092 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954091 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954090 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954089 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954088 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954087 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954086 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954085 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954084 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954083 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954082 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954081 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954080 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954079 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954078 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954077 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954076 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954075 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954074 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954073 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954072 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954071 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954070 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954069 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954068 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954067 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954066 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954065 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954064 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954063 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954062 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954061 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954060 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954059 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954058 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954057 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954056 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954055 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954054 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954053 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954052 Keywords=None Message=Completed invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954051 Keywords=None Message=Started invocation of ScriptBlock ID: 82575cea-4380-4a5a-a95d-ef81a18595e8 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954050 Keywords=None Message=Completed invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954049 Keywords=None Message=Started invocation of ScriptBlock ID: 05434ec7-52ed-41cf-96e8-07eed3783954 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954048 Keywords=None Message=Completed invocation of ScriptBlock ID: 502e0f30-593f-4f1c-934d-442efa888b45 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954047 Keywords=None Message=Started invocation of ScriptBlock ID: 502e0f30-593f-4f1c-934d-442efa888b45 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954046 Keywords=None Message=Completed invocation of ScriptBlock ID: 502e0f30-593f-4f1c-934d-442efa888b45 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954045 Keywords=None Message=Started invocation of ScriptBlock ID: 502e0f30-593f-4f1c-934d-442efa888b45 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954044 Keywords=None Message=Completed invocation of ScriptBlock ID: 502e0f30-593f-4f1c-934d-442efa888b45 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954043 Keywords=None Message=Started invocation of ScriptBlock ID: 502e0f30-593f-4f1c-934d-442efa888b45 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954042 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954041 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954040 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954039 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954038 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954037 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954036 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954035 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954034 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954033 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954032 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954031 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954030 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954029 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954028 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954027 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954026 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954025 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954024 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954023 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954022 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954021 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954020 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954019 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954018 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954017 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954016 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954015 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954014 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954013 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954012 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954011 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954010 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954009 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954008 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954007 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954006 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954005 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954004 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954003 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954002 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2954001 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2954000 Keywords=None Message=Completed invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953999 Keywords=None Message=Started invocation of ScriptBlock ID: d26508ed-bc40-4661-b5aa-8b6a9cb4bbbc Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2953998 Keywords=None Message=Started invocation of ScriptBlock ID: f4cb33a3-90bf-45ac-ba1d-af23ce7f1223 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=2953997 Keywords=None Message=Creating Scriptblock text (1 of 1): Get-DomainComputer -TrustedToAuth ScriptBlock ID: f4cb33a3-90bf-45ac-ba1d-af23ce7f1223 Path: 03/31/2022 06:15:38 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2953996 Keywords=None Message=Completed invocation of ScriptBlock ID: 4cf438a2-c825-4abf-aae8-3d68f71a44f5 Runspace ID: 613e7c9a-39f1-4984-8f85-0720fb2af8cc