03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952247 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952246 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952245 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952244 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952243 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952242 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952241 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952240 Keywords=None Message=Completed invocation of ScriptBlock ID: ad26a967-36a9-4136-946d-0cd85d753573 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952239 Keywords=None Message=Started invocation of ScriptBlock ID: ad26a967-36a9-4136-946d-0cd85d753573 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952238 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952237 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952236 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952235 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952234 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952233 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952232 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952231 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952230 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952229 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952228 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952227 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952226 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952225 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952224 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952223 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952222 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952221 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952220 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952219 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952218 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952217 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952216 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952215 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952214 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952213 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952212 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952211 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952210 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952209 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952208 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952207 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952206 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952205 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952204 Keywords=None Message=Completed invocation of ScriptBlock ID: de926925-75ed-4fb5-8e69-26e17a5c078d Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952203 Keywords=None Message=Started invocation of ScriptBlock ID: de926925-75ed-4fb5-8e69-26e17a5c078d Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952202 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952201 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952200 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952199 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952198 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952197 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952196 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952195 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952194 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952193 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952192 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952191 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952190 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952189 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952188 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952187 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952186 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952185 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952184 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952183 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952182 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952181 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952180 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952179 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952178 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952177 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952176 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952175 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952174 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952173 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952172 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952171 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952170 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952169 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952168 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952167 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952166 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952165 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952164 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952163 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952162 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952161 Keywords=None Message=Started invocation of ScriptBlock ID: 261dfe93-b0c9-47c4-b64e-0ccf31e277b6 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952160 Keywords=None Message=Completed invocation of ScriptBlock ID: 3e5922e4-fab6-4731-9a5e-9e18b0f44d05 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952159 Keywords=None Message=Started invocation of ScriptBlock ID: 3e5922e4-fab6-4731-9a5e-9e18b0f44d05 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952158 Keywords=None Message=Completed invocation of ScriptBlock ID: 546b1deb-af4a-41f1-9beb-d866607968d5 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952157 Keywords=None Message=Started invocation of ScriptBlock ID: 546b1deb-af4a-41f1-9beb-d866607968d5 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952156 Keywords=None Message=Completed invocation of ScriptBlock ID: 1095858d-af87-4727-9c71-7e9ee4595d18 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952155 Keywords=None Message=Started invocation of ScriptBlock ID: 1095858d-af87-4727-9c71-7e9ee4595d18 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952154 Keywords=None Message=Completed invocation of ScriptBlock ID: 81a6374e-0dbb-416d-a458-8bf21dba947e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952153 Keywords=None Message=Started invocation of ScriptBlock ID: 81a6374e-0dbb-416d-a458-8bf21dba947e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952152 Keywords=None Message=Completed invocation of ScriptBlock ID: 4674755b-9bba-4814-b04d-f0b795727e11 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952151 Keywords=None Message=Started invocation of ScriptBlock ID: 4674755b-9bba-4814-b04d-f0b795727e11 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952150 Keywords=None Message=Completed invocation of ScriptBlock ID: 6ce18b07-2618-4a72-b101-1153d51300ce Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952149 Keywords=None Message=Started invocation of ScriptBlock ID: 6ce18b07-2618-4a72-b101-1153d51300ce Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952148 Keywords=None Message=Completed invocation of ScriptBlock ID: 6ce18b07-2618-4a72-b101-1153d51300ce Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952147 Keywords=None Message=Started invocation of ScriptBlock ID: 6ce18b07-2618-4a72-b101-1153d51300ce Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952146 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952145 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952144 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952143 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952142 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952141 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952140 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952139 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952138 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952137 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952136 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952135 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952134 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952133 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952132 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952131 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952130 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952129 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952128 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952127 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952126 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952125 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952124 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952123 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952122 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952121 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952120 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952119 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952118 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952117 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952116 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952115 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952114 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952113 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952112 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952111 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952110 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952109 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952108 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952107 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952106 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952105 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952104 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952103 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952102 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952101 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952100 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952099 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952098 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952097 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952096 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952095 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952094 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952093 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952092 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952091 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952090 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952089 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952088 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952087 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952086 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952085 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952084 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952083 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952082 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952081 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952080 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952079 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952078 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952077 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952076 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952075 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952074 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952073 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952072 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952071 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952070 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952069 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952068 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952067 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952066 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952065 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952064 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952063 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952062 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952061 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952060 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952059 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952058 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952057 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952056 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952055 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952054 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952053 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952052 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952051 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952050 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952049 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952048 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952047 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952046 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952045 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952044 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952043 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952042 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952041 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952040 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952039 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952038 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952037 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952036 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952035 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952034 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952033 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952032 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952031 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952030 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952029 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952028 Keywords=None Message=Completed invocation of ScriptBlock ID: 517c7d1e-84bb-4a31-acee-1c1d67298693 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952027 Keywords=None Message=Started invocation of ScriptBlock ID: 517c7d1e-84bb-4a31-acee-1c1d67298693 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952026 Keywords=None Message=Completed invocation of ScriptBlock ID: 517c7d1e-84bb-4a31-acee-1c1d67298693 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952025 Keywords=None Message=Started invocation of ScriptBlock ID: 517c7d1e-84bb-4a31-acee-1c1d67298693 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952024 Keywords=None Message=Completed invocation of ScriptBlock ID: 517c7d1e-84bb-4a31-acee-1c1d67298693 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952023 Keywords=None Message=Started invocation of ScriptBlock ID: 517c7d1e-84bb-4a31-acee-1c1d67298693 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952022 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952021 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952020 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952019 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952018 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952017 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952016 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952015 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952014 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952013 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952012 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952011 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952010 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952009 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952008 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952007 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952006 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952005 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952004 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952003 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952002 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952001 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952000 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2951999 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2951998 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2951997 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2951996 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2951995 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2951994 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2951993 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2951992 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2951991 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2951990 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2951989 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2951988 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2951987 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2951986 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2951985 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2951984 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2951983 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2951982 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2951981 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2951980 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2951979 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2951978 Keywords=None Message=Started invocation of ScriptBlock ID: 6e5ad42a-82db-4eba-8637-fcb046ee4db5 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=2951977 Keywords=None Message=Creating Scriptblock text (1 of 1): Get-DomainComputer -Unconstrained ScriptBlock ID: 6e5ad42a-82db-4eba-8637-fcb046ee4db5 Path: 03/28/2022 06:56:10 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2951976 Keywords=None Message=Completed invocation of ScriptBlock ID: 064f1821-50e0-4724-af0f-cda16658beff Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952337 Keywords=None Message=Started invocation of ScriptBlock ID: 064f1821-50e0-4724-af0f-cda16658beff Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952336 Keywords=None Message=Completed invocation of ScriptBlock ID: 5431d989-a9ac-4f60-b9c7-c54e456cccad Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952335 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fe0528a-6c3e-48b3-98ba-172b9aa2e4d8 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952334 Keywords=None Message=Started invocation of ScriptBlock ID: 6fe0528a-6c3e-48b3-98ba-172b9aa2e4d8 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952333 Keywords=None Message=Started invocation of ScriptBlock ID: 5431d989-a9ac-4f60-b9c7-c54e456cccad Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=2952332 Keywords=None Message=Creating Scriptblock text (1 of 1): prompt ScriptBlock ID: 5431d989-a9ac-4f60-b9c7-c54e456cccad Path: 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952331 Keywords=None Message=Completed invocation of ScriptBlock ID: c019eade-ed85-4337-843e-decbce4e0807 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952330 Keywords=None Message=Started invocation of ScriptBlock ID: c019eade-ed85-4337-843e-decbce4e0807 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952329 Keywords=None Message=Completed invocation of ScriptBlock ID: 6e5ad42a-82db-4eba-8637-fcb046ee4db5 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952328 Keywords=None Message=Completed invocation of ScriptBlock ID: 261dfe93-b0c9-47c4-b64e-0ccf31e277b6 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952327 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952326 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952325 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952324 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952323 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952322 Keywords=None Message=Completed invocation of ScriptBlock ID: ad26a967-36a9-4136-946d-0cd85d753573 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952321 Keywords=None Message=Started invocation of ScriptBlock ID: ad26a967-36a9-4136-946d-0cd85d753573 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952320 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952319 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952318 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952317 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952316 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952315 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952314 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952313 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952312 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952311 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952310 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952309 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952308 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952307 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952306 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952305 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952304 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952303 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952302 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952301 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952300 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952299 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952298 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952297 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952296 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952295 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952294 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952293 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952292 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952291 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952290 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952289 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952288 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952287 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952286 Keywords=None Message=Completed invocation of ScriptBlock ID: de926925-75ed-4fb5-8e69-26e17a5c078d Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952285 Keywords=None Message=Started invocation of ScriptBlock ID: de926925-75ed-4fb5-8e69-26e17a5c078d Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952284 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952283 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952282 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952281 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952280 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952279 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952278 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952277 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952276 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952275 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952274 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952273 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952272 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952271 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952270 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952269 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952268 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952267 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952266 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952265 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952264 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952263 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952262 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952261 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952260 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952259 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952258 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952257 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952256 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952255 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952254 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952253 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952252 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952251 Keywords=None Message=Started invocation of ScriptBlock ID: 261dfe93-b0c9-47c4-b64e-0ccf31e277b6 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952250 Keywords=None Message=Completed invocation of ScriptBlock ID: 3e5922e4-fab6-4731-9a5e-9e18b0f44d05 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952249 Keywords=None Message=Started invocation of ScriptBlock ID: 3e5922e4-fab6-4731-9a5e-9e18b0f44d05 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:11 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952248 Keywords=None Message=Completed invocation of ScriptBlock ID: 261dfe93-b0c9-47c4-b64e-0ccf31e277b6 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952609 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952608 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952607 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952606 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952605 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952604 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952603 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952602 Keywords=None Message=Completed invocation of ScriptBlock ID: ad26a967-36a9-4136-946d-0cd85d753573 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952601 Keywords=None Message=Started invocation of ScriptBlock ID: ad26a967-36a9-4136-946d-0cd85d753573 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952600 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952599 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952598 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952597 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952596 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952595 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952594 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952593 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952592 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952591 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952590 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952589 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952588 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952587 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952586 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952585 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952584 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952583 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952582 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952581 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952580 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952579 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952578 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952577 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952576 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952575 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952574 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952573 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952572 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952571 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952570 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952569 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952568 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952567 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952566 Keywords=None Message=Completed invocation of ScriptBlock ID: de926925-75ed-4fb5-8e69-26e17a5c078d Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952565 Keywords=None Message=Started invocation of ScriptBlock ID: de926925-75ed-4fb5-8e69-26e17a5c078d Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952564 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952563 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952562 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952561 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952560 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952559 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952558 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952557 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952556 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952555 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952554 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952553 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952552 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952551 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952550 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952549 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952548 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952547 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952546 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952545 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952544 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952543 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952542 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952541 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952540 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952539 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952538 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952537 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952536 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952535 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952534 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952533 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952532 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952531 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952530 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952529 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952528 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952527 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952526 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952525 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952524 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952523 Keywords=None Message=Started invocation of ScriptBlock ID: 261dfe93-b0c9-47c4-b64e-0ccf31e277b6 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952522 Keywords=None Message=Completed invocation of ScriptBlock ID: 3e5922e4-fab6-4731-9a5e-9e18b0f44d05 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952521 Keywords=None Message=Started invocation of ScriptBlock ID: 3e5922e4-fab6-4731-9a5e-9e18b0f44d05 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952520 Keywords=None Message=Completed invocation of ScriptBlock ID: 546b1deb-af4a-41f1-9beb-d866607968d5 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952519 Keywords=None Message=Started invocation of ScriptBlock ID: 546b1deb-af4a-41f1-9beb-d866607968d5 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952518 Keywords=None Message=Completed invocation of ScriptBlock ID: 1095858d-af87-4727-9c71-7e9ee4595d18 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952517 Keywords=None Message=Started invocation of ScriptBlock ID: 1095858d-af87-4727-9c71-7e9ee4595d18 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952516 Keywords=None Message=Completed invocation of ScriptBlock ID: 81a6374e-0dbb-416d-a458-8bf21dba947e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952515 Keywords=None Message=Started invocation of ScriptBlock ID: 81a6374e-0dbb-416d-a458-8bf21dba947e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952514 Keywords=None Message=Completed invocation of ScriptBlock ID: 4674755b-9bba-4814-b04d-f0b795727e11 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952513 Keywords=None Message=Started invocation of ScriptBlock ID: 4674755b-9bba-4814-b04d-f0b795727e11 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952512 Keywords=None Message=Completed invocation of ScriptBlock ID: 6ce18b07-2618-4a72-b101-1153d51300ce Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952511 Keywords=None Message=Started invocation of ScriptBlock ID: 6ce18b07-2618-4a72-b101-1153d51300ce Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952510 Keywords=None Message=Completed invocation of ScriptBlock ID: 6ce18b07-2618-4a72-b101-1153d51300ce Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952509 Keywords=None Message=Started invocation of ScriptBlock ID: 6ce18b07-2618-4a72-b101-1153d51300ce Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952508 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952507 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952506 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952505 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952504 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952503 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952502 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952501 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952500 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952499 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952498 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952497 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952496 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952495 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952494 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952493 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952492 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952491 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952490 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952489 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952488 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952487 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952486 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952485 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952484 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952483 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952482 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952481 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952480 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952479 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952478 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952477 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952476 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952475 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952474 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952473 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952472 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952471 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952470 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952469 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952468 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952467 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952466 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952465 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952464 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952463 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952462 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952461 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952460 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952459 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952458 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952457 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952456 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952455 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952454 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952453 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952452 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952451 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952450 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952449 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952448 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952447 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952446 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952445 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952444 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952443 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952442 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952441 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952440 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952439 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952438 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952437 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952436 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952435 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952434 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952433 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952432 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952431 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952430 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952429 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952428 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952427 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952426 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952425 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952424 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952423 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952422 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952421 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952420 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952419 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952418 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952417 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952416 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952415 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952414 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952413 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952412 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952411 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952410 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952409 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952408 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952407 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952406 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952405 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952404 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952403 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952402 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952401 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952400 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952399 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952398 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952397 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952396 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952395 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952394 Keywords=None Message=Completed invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952393 Keywords=None Message=Started invocation of ScriptBlock ID: 97bd03bf-6726-4003-ac88-8bc8eab14729 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952392 Keywords=None Message=Completed invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952391 Keywords=None Message=Started invocation of ScriptBlock ID: 52ca9bbc-0b38-4a98-808c-7555c6a0e19e Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952390 Keywords=None Message=Completed invocation of ScriptBlock ID: 517c7d1e-84bb-4a31-acee-1c1d67298693 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952389 Keywords=None Message=Started invocation of ScriptBlock ID: 517c7d1e-84bb-4a31-acee-1c1d67298693 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952388 Keywords=None Message=Completed invocation of ScriptBlock ID: 517c7d1e-84bb-4a31-acee-1c1d67298693 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952387 Keywords=None Message=Started invocation of ScriptBlock ID: 517c7d1e-84bb-4a31-acee-1c1d67298693 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952386 Keywords=None Message=Completed invocation of ScriptBlock ID: 517c7d1e-84bb-4a31-acee-1c1d67298693 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952385 Keywords=None Message=Started invocation of ScriptBlock ID: 517c7d1e-84bb-4a31-acee-1c1d67298693 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952384 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952383 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952382 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952381 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952380 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952379 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952378 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952377 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952376 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952375 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952374 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952373 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952372 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952371 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952370 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952369 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952368 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952367 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952366 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952365 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952364 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952363 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952362 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952361 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952360 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952359 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952358 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952357 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952356 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952355 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952354 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952353 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952352 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952351 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952350 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952349 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952348 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952347 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952346 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952345 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952344 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952343 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952342 Keywords=None Message=Completed invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952341 Keywords=None Message=Started invocation of ScriptBlock ID: ebc67eb4-d2c9-4206-a9fc-be87fdea4147 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952340 Keywords=None Message=Started invocation of ScriptBlock ID: ef012439-ace0-4026-b50d-64bdbcf31eaa Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=2952339 Keywords=None Message=Creating Scriptblock text (1 of 1): Get-NetComputer -Unconstrained ScriptBlock ID: ef012439-ace0-4026-b50d-64bdbcf31eaa Path: 03/28/2022 06:56:14 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952338 Keywords=None Message=Completed invocation of ScriptBlock ID: 064f1821-50e0-4724-af0f-cda16658beff Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952699 Keywords=None Message=Started invocation of ScriptBlock ID: 064f1821-50e0-4724-af0f-cda16658beff Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952698 Keywords=None Message=Completed invocation of ScriptBlock ID: 91c6716a-277c-4bae-964c-cc693dba0bbb Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952697 Keywords=None Message=Completed invocation of ScriptBlock ID: 6fe0528a-6c3e-48b3-98ba-172b9aa2e4d8 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952696 Keywords=None Message=Started invocation of ScriptBlock ID: 6fe0528a-6c3e-48b3-98ba-172b9aa2e4d8 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952695 Keywords=None Message=Started invocation of ScriptBlock ID: 91c6716a-277c-4bae-964c-cc693dba0bbb Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4104 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Execute a Remote Command OpCode=On create calls RecordNumber=2952694 Keywords=None Message=Creating Scriptblock text (1 of 1): prompt ScriptBlock ID: 91c6716a-277c-4bae-964c-cc693dba0bbb Path: 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952693 Keywords=None Message=Completed invocation of ScriptBlock ID: c019eade-ed85-4337-843e-decbce4e0807 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952692 Keywords=None Message=Started invocation of ScriptBlock ID: c019eade-ed85-4337-843e-decbce4e0807 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952691 Keywords=None Message=Completed invocation of ScriptBlock ID: ef012439-ace0-4026-b50d-64bdbcf31eaa Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952690 Keywords=None Message=Completed invocation of ScriptBlock ID: 261dfe93-b0c9-47c4-b64e-0ccf31e277b6 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952689 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952688 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952687 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952686 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952685 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952684 Keywords=None Message=Completed invocation of ScriptBlock ID: ad26a967-36a9-4136-946d-0cd85d753573 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952683 Keywords=None Message=Started invocation of ScriptBlock ID: ad26a967-36a9-4136-946d-0cd85d753573 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952682 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952681 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952680 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952679 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952678 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952677 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952676 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952675 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952674 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952673 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952672 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952671 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952670 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952669 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952668 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952667 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952666 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952665 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952664 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952663 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952662 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952661 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952660 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952659 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952658 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952657 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952656 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952655 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952654 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952653 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952652 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952651 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952650 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952649 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952648 Keywords=None Message=Completed invocation of ScriptBlock ID: de926925-75ed-4fb5-8e69-26e17a5c078d Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952647 Keywords=None Message=Started invocation of ScriptBlock ID: de926925-75ed-4fb5-8e69-26e17a5c078d Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952646 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952645 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952644 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952643 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952642 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952641 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952640 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952639 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952638 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952637 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952636 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952635 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952634 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952633 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952632 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952631 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952630 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952629 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952628 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952627 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952626 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952625 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952624 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952623 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952622 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952621 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952620 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952619 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952618 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952617 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952616 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952615 Keywords=None Message=Completed invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952614 Keywords=None Message=Started invocation of ScriptBlock ID: 8b69b094-8e1f-4047-b1ba-765c7406fd31 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952613 Keywords=None Message=Started invocation of ScriptBlock ID: 261dfe93-b0c9-47c4-b64e-0ccf31e277b6 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952612 Keywords=None Message=Completed invocation of ScriptBlock ID: 3e5922e4-fab6-4731-9a5e-9e18b0f44d05 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4105 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Starting Command OpCode=On create calls RecordNumber=2952611 Keywords=None Message=Started invocation of ScriptBlock ID: 3e5922e4-fab6-4731-9a5e-9e18b0f44d05 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e 03/28/2022 06:56:15 PM LogName=Microsoft-Windows-PowerShell/Operational SourceName=Microsoft-Windows-PowerShell EventCode=4106 EventType=5 Type=Verbose ComputerName=win-dc-128.attackrange.local User=NOT_TRANSLATED Sid=S-1-5-21-1166625382-1442148322-2337405042-500 SidType=0 TaskCategory=Stopping Command OpCode=On create calls RecordNumber=2952610 Keywords=None Message=Completed invocation of ScriptBlock ID: 261dfe93-b0c9-47c4-b64e-0ccf31e277b6 Runspace ID: 394dd9d0-eeff-4fa0-b5d5-b60602a87c5e